cPanel Remote Backup Information Disclosure Vulnerability

Bugtraq ID:	11449
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 18 2004 12:00AM
Updated:	Oct 18 2004 12:00AM
Credit:	Karol Wi?sek <[email protected]> disclosed this vulnerability.
Vulnerable:	cPanel cPanel 9.4.1 -R64
Not Vulnerable:

cPanel Remote Backup Information Disclosure Vulnerability

It is reported that cPanel is susceptible to an information disclosure vulnerability in its remote backup function.

Attackers can reportedly exploit this vulnerability to retrieve the contents of potentially sensitive files located in the same slice as their home directory. This may aid them in further attacks.

Version 9.4.1-RELEASE-64 of cPanel was reported vulnerable. Other versions may also be affected.

cPanel Remote Backup Information Disclosure Vulnerability

An exploit is not required.

cPanel Remote Backup Information Disclosure Vulnerability

Solution:
The vendor has released fixes dealing with this issue. Users are advised to update to the latest Edge or Current version of cPanel. This update can be uploaded from WHM under 'Update to Latest Version' if the update preferences are set to 'Edge' or 'Current'. It can also be updated from a shell by running '/scripts/upcp'. For more information please see the referenced vendor message.

cPanel Remote Backup Information Disclosure Vulnerability

References:

• cPanel Homepage (cPanel)
  
• cPanel hardlink backup issue (Karol Wi?sek )