Sometimes it isn't the latest and greatest bug that gets the most utility from the criminals on the Internet, it's the easiest and most reliable.  We received some solid analysis from a large hosting provider showing that Webmin versions below 1.290 are still being actively exploited.  Version 1.290 that fixes the problem was released in June 2006, so the exploit is several months old.

To give some insight, this particular bug allows the attacker to read any file from the target as the root user.  So the attacker is grabbing /etc/passwd and /etc/shadow from targets and then running john the ripper against the encrypted passwords.  There is a nice auto-rooter toolkit that has a .ro (Romania) e-mail address claiming authorship.

While there is nothing exotic or shocking about any of this, it's still important for us to think about *NIX security.  We don't want all the *NIX folks out there feeling that Microsoft client-side bugs are getting all the attention lately.