cPanel Multiple Security Vulnerabilities
BID:62140
Info
cPanel Multiple Security Vulnerabilities
| Bugtraq ID: | 62140 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Aug 29 2013 12:00AM |
| Updated: | Aug 29 2013 12:00AM |
| Credit: | Vendor and Rack911 |
| Vulnerable: |
cPanel cPanel 11.34 cPanel cPanel 11.39.0.5 cPanel cPanel 11.39.0.4 cPanel cPanel 11.39.0.14 cPanel cPanel 11.38.2.5 cPanel cPanel 11.38.1.4 cPanel cPanel 11.38.1.3 cPanel cPanel 11.38.1.13 cPanel cPanel 11.38.1.12 cPanel cPanel 11.38.0.19 cPanel cPanel 11.38.0.18 cPanel cPanel 11.36.2.2 cPanel cPanel 11.36.1.9 cPanel cPanel 11.36.1.8 cPanel cPanel 11.36.1.15 cPanel cPanel 11.36.1.14 cPanel cPanel 11.34.2.3 cPanel cPanel 11.34.1.25 cPanel cPanel 11.34.1.24 cPanel cPanel 11.34.1.17 cPanel cPanel 11.34.1.16 cPanel cPanel 11.34.0.11 cPanel cPanel 11.34.0.10 cPanel cPanel 11.32.7.2 cPanel cPanel 11.32.6.8 cPanel cPanel 11.32.6.7 cPanel cPanel 11.32.6.17 cPanel cPanel 11.32.6.16 cPanel cPanel 11.32.5.15 cPanel cPanel 11.32.5.14 |
| Not Vulnerable: |
cPanel cPanel 11.39.0.15 cPanel cPanel 11.38.2.6 cPanel cPanel 11.36.2.3 cPanel cPanel 11.34.2.4 cPanel cPanel 11.32.7.3 |
Discussion
cPanel Multiple Security Vulnerabilities
cPanel is prone to the following multiple remote security vulnerabilities:
1. An insecure file-permission vulnerability
2. A denial-of-service vulnerability
3. An arbitrary file-overwrite vulnerability
4. Multiple security-bypass vulnerabilities
5. An HTML-injection vulnerability
6. An arbitrary code-execution vulnerability
7. A directory-traversal vulnerability
Attackers can exploit these issues to bypass certain security restrictions, steal cookie-based authentication credentials,insert malicious HTML and script codes, access or overwrite arbitrary files, disclose sensitive information, execute arbitrary code or cause denial-of-service conditions. Other attacks are possible.
cPanel versions prior to 11.32.7.3, 11.34.2.4, 11.36.2.3, 11.38.2.6, and 11.39.0.15 are vulnerable.
cPanel is prone to the following multiple remote security vulnerabilities:
1. An insecure file-permission vulnerability
2. A denial-of-service vulnerability
3. An arbitrary file-overwrite vulnerability
4. Multiple security-bypass vulnerabilities
5. An HTML-injection vulnerability
6. An arbitrary code-execution vulnerability
7. A directory-traversal vulnerability
Attackers can exploit these issues to bypass certain security restrictions, steal cookie-based authentication credentials,insert malicious HTML and script codes, access or overwrite arbitrary files, disclose sensitive information, execute arbitrary code or cause denial-of-service conditions. Other attacks are possible.
cPanel versions prior to 11.32.7.3, 11.34.2.4, 11.36.2.3, 11.38.2.6, and 11.39.0.15 are vulnerable.
Exploit / POC
cPanel Multiple Security Vulnerabilities
Attackers can exploit some of these issues through browser or using readily available tools.
Attackers can exploit some of these issues through browser or using readily available tools.
Solution / Fix
cPanel Multiple Security Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.