CVE-2002-1672 in Webmin
Summary
by MITRE
Webmin 0.92, when installed from an RPM, creates /var/webmin with insecure permissions (world readable), which could allow local users to read the root user s cookie-based authentication credentials and possibly hijack the root user s session using the credentials.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 01/12/2025
The vulnerability identified as CVE-2002-1672 represents a critical privilege escalation risk in the Webmin web-based system administration tool version 0.92. This issue specifically affects installations that utilize RPM package management systems and stems from improper permission configuration during the installation process. The flaw creates a persistent security weakness that can be exploited by local attackers to gain elevated privileges and potentially compromise the entire system.
The technical root cause of this vulnerability lies in the insecure permission settings applied to the /var/webmin directory during Webmin's RPM installation. This directory, which serves as the primary storage location for Webmin's operational files and authentication data, is configured with world-readable permissions that allow any local user to access its contents. The vulnerability specifically impacts the storage of root user cookie-based authentication credentials, which are typically used to maintain persistent administrative sessions within the Webmin interface. When these credentials are stored in an accessible location, they become susceptible to unauthorized retrieval by local attackers who can then leverage them to impersonate the root user.
The operational impact of this vulnerability extends beyond simple information disclosure, as it enables full administrative session hijacking. Local users who can read the authentication cookies stored in /var/webmin gain the ability to impersonate the root user and execute arbitrary commands with the highest system privileges. This creates a direct path to system compromise that bypasses traditional authentication mechanisms and can be exploited without requiring network access or external attack vectors. The vulnerability is particularly concerning because it affects the fundamental security model of Webmin's authentication system and can be exploited by any user with local access to the system.
The implications of this vulnerability align with CWE-732, which addresses inadequate permissions for critical resources, and can be categorized under ATT&CK technique T1068 for local privilege escalation. The insecure permissions create a persistent backdoor that can be exploited repeatedly by local users, making it a particularly dangerous flaw in multi-user environments where privilege separation is critical. Security practitioners should consider this vulnerability as part of broader system hardening efforts, particularly in environments where local access control is not properly enforced. The vulnerability demonstrates the importance of proper file permission management during software installation and highlights the need for comprehensive security reviews of installed system components.
Mitigation strategies should focus on immediate permission correction and ongoing monitoring of system integrity. System administrators must manually verify and correct the permissions on the /var/webmin directory to ensure that only authorized users can access its contents. The directory should be configured with restrictive permissions such as 700 or 750, ensuring that only the webmin user and potentially the root user can access the directory contents. Additionally, administrators should implement regular security audits to verify that no other system directories have been configured with similar insecure permissions. The installation process itself should be reviewed to ensure that future deployments properly enforce secure permission settings and that the system maintains appropriate access controls throughout its operational lifecycle.