CPanel SUID Wrapper Remote Privilege Escalation Vulnerability

Bugtraq ID:	20163
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 24 2006 12:00AM
Updated:	Oct 13 2006 06:59PM
Credit:	HostGator has reported this vulnerability.
Vulnerable:	cPanel cPanel 10.8.2 118 cPanel cPanel 10.8.1 113 cPanel cPanel 10.8.1 (build 84) cPanel cPanel 10.6 .0-R137 cPanel cPanel 10.2 .0-R82 cPanel cPanel 9.9.1 -R3 cPanel cPanel 9.4.1 -R64 cPanel cPanel 9.1 .0-R85 cPanel cPanel 9.1 cPanel cPanel 9.0 cPanel cPanel 8.0 cPanel cPanel 7.0 cPanel cPanel 6.4.2 .STABLE_48 cPanel cPanel 6.4.2 cPanel cPanel 6.4.1 cPanel cPanel 6.4 cPanel cPanel 6.2 cPanel cPanel 6.0 cPanel cPanel 5.3 cPanel cPanel 5.0 cPanel cPanel 10
Not Vulnerable:	cPanel cPanel 10.9

CPanel SUID Wrapper Remote Privilege Escalation Vulnerability

cPanel is prone to a remote privilege-escalation vulnerability.

A remote attacker can exploit this issue to gain administrative access to the affected application. This may lead to other attacks.

CPanel SUID Wrapper Remote Privilege Escalation Vulnerability

An attacker requires a valid cPanel account to exploit this issue.

The following exploit code is available:

• /data/vulnerabilities/exploits/20163
• /data/vulnerabilities/exploits/Nima.php

CPanel SUID Wrapper Remote Privilege Escalation Vulnerability

Solution:
The vendor has released a fix to address this issue. Please contact the vendor for information on how to obtain and apply this fix.

CPanel SUID Wrapper Remote Privilege Escalation Vulnerability

References:

• cPanel Change Log (cPanel)
  
• cPanel Exploit Used to Circulate IE Exploit (Zonk)
  
• cPanel Homepage (cPanel)