ClueCentral Apache Suexec Patch Security Weakness

Bugtraq ID:	10478
Class:	Access Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Jun 07 2004 12:00AM
Updated:	Jun 07 2004 12:00AM
Credit:	Discovery of this weakness is credited to Rob Brown <[email protected]>.
Vulnerable:	cluecentral suexec.patch + cPanel cPanel 9.1 .0-R85 + cPanel cPanel 9.1 + cPanel cPanel 9.0 + cPanel cPanel 8.0 + cPanel cPanel 7.0 + cPanel cPanel 6.4.2 .STABLE_48 + cPanel cPanel 6.4.2 + cPanel cPanel 6.4.1 + cPanel cPanel 6.4 + cPanel cPanel 6.2 + cPanel cPanel 6.0 + cPanel cPanel 5.3 + cPanel cPanel 5.0
Not Vulnerable:

ClueCentral Apache Suexec Patch Security Weakness

cluecentral Apache suexec patch is reported prone to a local security weakness. It is reported that the patch that is applied to Apache suexec makes suexec insecure. The patch reportedly removes security checks on insecure directory permissions and permits the execution of files owned by arbitrary users, by the 'nobody' user.

A local attacker who has permissions to create, publish and request PHP web content on the affected system may exploit this weakness in conjunction with other security vulnerabilities to achieve some degree of privilege escalation.

ClueCentral Apache Suexec Patch Security Weakness

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

ClueCentral Apache Suexec Patch Security Weakness

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

ClueCentral Apache Suexec Patch Security Weakness

References:

• Suexec patch (cluecentral)
  
• cPanel mod_php suEXEC Taint Vulnerability (Rob Brown )