Re: [webmin-l] Nessus finds remote Webmin web server vulnerabilities

[Craig W. <cra...@az...>]

On Sat, 2005-10-08 at 11:40 +0200, Georgi Lipov wrote:
> Hey, all
> 
> Yesterday I did a thorough nessus scan on a second box of mine, running
> Debian 3.0 with the latest updates and Webmin 1.230 (I installed some
> older version through apt-get first, then updated it through the webmin
> interface.) This is what nessus found:
> 

> 
> Can anyone confirm this?
----
according to IANA the webmin default port 10000 got registered to the
people that make the netapp filer.

http://www.iana.org/assignments/port-numbers

This isn't the same as Webmin so Nessus isn't really identifying Webmin
as running on port 10000 - which is made all the more obvious by it's
thinking that it is running Apache web server < 2.0.46 (which itself
seems a little old unless it's RHEL 3 backported patches ad infinitum)

Not sure what you wish confirmed - that nessus didn't identify webmin?
That it's running Apache web server 2.0.46 or greater (it's not running
apache web server at all) or that long URL's are gonna crash it (don't
think so - Jamie?)

Craig


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.