PDA

View Full Version : 09/24/06 - (VDS) Critical cPanel Update - old


Jeff
09-24-2006, 02:38 AM
This thread has been closed
Please refer to the latest thread, which has been posted here:
http://forum.myriadnetwork.com/showthread.php?t=237

--


A critical vulnerability has been found and is actively being exploited on unpatched cPanel servers. Details are currently sparse, but you can find more information here:

http://forums.cpanel.net/showthread.php?t=58090


Q. How do I know if my version of cPanel is vulnerable?
A. Run the following perl script on your server (as posted in the cPanel thread above, on page 5, by cPanel staff member Nick):


#!/usr/bin/perl

my $v=0;
my $b='/usr/local/cpanel/bin';
my $a='admin';
my $s=[98,46,46,112,101,114,108];
my $st=join('',map { chr($_); } @{$s} );
foreach my $f ("$b/mysql$a","$b/hooks$a")
{
next if (! -e $f);
my $ft;
open(my $fh,'<',$f);
while(readline($fh)) {
$ft.=$_;
}
if($ft !~ /${st}/) {
$v=1;
}
}
print "\n\n".($v?'not safe':'safe')."\n\n";



You do not need to be root to run the check.

Q. How do I use or run this code?
A.

1. Log into the shell via ssh

2. Paste the contents into a file:
cat > cpseccheck.pl
(paste the contents here, and hit enter until you are on a blank line)
(hit control+c)

3. Type: perl cpseccheck.pl


This will come back with 1 of 2 things: safe, or not safe.

If it comes back as safe, no action on your part is required, as your server was likely already updated during a nightly cPanel update.

If it comes back as not safe, then you need to update your cPanel install. This can be done by running the following command, as root, from the shell:

/scripts/upcp

4. Be patient, this may take a while. When this is done, re run the cpseccheck.pl and it should now say "safe".



If you have any questions, please feel free to post them here, or to open a ticket. If you need direct assistance, please open a ticket and be sure to provide your VEID (this is the 3 digit VDS ID number provided in your Welcome email), or your dedicated server ID.

javaj
09-24-2006, 04:55 AM
Thanks,

Does cpanel or whm have a security mailing list? I am on the forums every few days but not nearly enough to catch stuff like this right away.

Another suggestion for those who dont know about it is to have whm do a nightly update, go to: Add-ons > Configure cPanel Cron Times. That way if there is an exploit like this at least it gets patched or updated that night if you otherwise miss an announcement.

Cam

Jeff
09-24-2006, 05:05 AM
Thanks,

Does cpanel or whm have a security mailing list? I am on the forums every few days but not nearly enough to catch stuff like this right away.

Another suggestion for those who dont know about it is to have whm do a nightly update, go to: Add-ons > Configure cPanel Cron Times. That way if there is an exploit like this at least it gets patched or updated that night if you otherwise miss an announcement.

Cam


Excellent post Cam, thanks for posting that. For those that have updates enabled automatically, by the time they see this thread, they will likely be patched against this specific vulnerability already. This is all the more reason to ensure you are updating nightly.


As far as a cPanel security list, there are none that I am aware of. What I keep my eyes on are the following:

http://forums.cpanel.net


bugzilla.cpanel.net RSS feed
cPanel bugzilla (http://bugzilla.cpanel.net/buglist.cgi?query_format=specific&bug_status=__open__&product=cPanel%20%2F%20WebHost%20Manager&content=&ctype=rss)

cPanel Changelog RSS feed
cPanel Changelog (http://changelog.cpanel.net/changelog/ChangeLog.cgi?output=rdf)

Every once in a while you can find some information that has made its way to the webhosting community before it appears on cPanels' sites, such as webhostingtalk.com.


Please note before clicking the cPanel bugzilla RSS feed: due to the numerous amount of open bug reports, this may freeze your browser up for a little while as it reads in all the previous bug reports for RSS. You may then also have to remove all the old bug reports from your feed.

It's not that there are still numerous outstanding issues with cPanel, but that they don't often close bugzilla reports unless they are marked as RESOLVED. Many of the others are merely enhancement requests, or invalid reports.

javaj
09-24-2006, 05:33 AM
Thanks for the info jeff, I ran the test just before I posted and it was safe, so I agree its pretty vital to run it nightly...

Jeff
09-24-2006, 08:41 PM
This thread will be closed shortly, and a new thread with the latest details will be posted. In short, even if you've already patched, you will need to again. I will be posting the new thread soon and closing this one.