cPanel Front Page Extension Installation File Ownership Vulnerability
BID:11455
Info
cPanel Front Page Extension Installation File Ownership Vulnerability
| Bugtraq ID: | 11455 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 18 2004 12:00AM |
| Updated: | Oct 18 2004 12:00AM |
| Credit: | Karol Wi?sek <[email protected]> disclosed this vulnerability. |
| Vulnerable: |
cPanel cPanel 9.4.1 -R64 |
| Not Vulnerable: | |
Discussion
cPanel Front Page Extension Installation File Ownership Vulnerability
It is reported that cPanel is susceptible to a file ownership vulnerability in its function to enable Front Page extensions.
This vulnerability allows malicious users to gain full access to potentially sensitive files. Depending on the layout of the hard drive slices, it may be possible for attackers to exploit this vulnerability to gain elevated privileges.
Version 9.4.1-RELEASE-64 of cPanel was reported vulnerable. Other versions may also be affected.
It is reported that cPanel is susceptible to a file ownership vulnerability in its function to enable Front Page extensions.
This vulnerability allows malicious users to gain full access to potentially sensitive files. Depending on the layout of the hard drive slices, it may be possible for attackers to exploit this vulnerability to gain elevated privileges.
Version 9.4.1-RELEASE-64 of cPanel was reported vulnerable. Other versions may also be affected.
Exploit / POC
cPanel Front Page Extension Installation File Ownership Vulnerability
An exploit is not required.
An exploit is not required.
Solution / Fix
cPanel Front Page Extension Installation File Ownership Vulnerability
Solution:
The vendor has released fixes dealing with this issue. Users are advised to update to the latest Edge or Current version of cPanel. This update can be uploaded from WHM under 'Update to Latest Version' if the update preferences are set to 'Edge' or 'Current'. It can also be updated from a shell by running '/scripts/upcp'. For more information please see the referenced vendor message.
Solution:
The vendor has released fixes dealing with this issue. Users are advised to update to the latest Edge or Current version of cPanel. This update can be uploaded from WHM under 'Update to Latest Version' if the update preferences are set to 'Edge' or 'Current'. It can also be updated from a shell by running '/scripts/upcp'. For more information please see the referenced vendor message.
References
cPanel Front Page Extension Installation File Ownership Vulnerability
References:
References:
- cPanel Homepage (cPanel)
- cPanel hardlink chown issue (Karol Wi?sek