DirectAdmin Backup Multiple Security Vulnerabilities
BID:62929
Info
DirectAdmin Backup Multiple Security Vulnerabilities
| Bugtraq ID: | 62929 |
| Class: | Unknown |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Oct 07 2013 12:00AM |
| Updated: | Oct 07 2013 12:00AM |
| Credit: | Rack911 |
| Vulnerable: |
JBMC Software DirectAdmin 1.33.6 JBMC Software DirectAdmin 1.33.4 JBMC Software DirectAdmin 1.33.3 JBMC Software DirectAdmin 1.30.2 JBMC Software DirectAdmin 1.30.1 JBMC Software DirectAdmin 1.43.1 JBMC Software DirectAdmin 1.43 JBMC Software DirectAdmin 1.403 JBMC Software DirectAdmin 1.382 JBMC Software DirectAdmin 1.381 JBMC Software DirectAdmin 1.38 JBMC Software DirectAdmin 1.351 JBMC Software DirectAdmin 1.292 |
| Not Vulnerable: |
JBMC Software DirectAdmin 1.44.0 |
Discussion
DirectAdmin Backup Multiple Security Vulnerabilities
DirectAdmin is prone to multiple security vulnerabilities. These include an arbitrary file-access vulnerability, multiple arbitrary-file-overwrite vulnerabilities and a privilege-escalation vulnerability.
An attacker can exploit these issues to execute arbitrary commands with root privileges, read arbitrary files or overwrite arbitrary files in the context of the user running the affected application. This may aid in further attacks.
Versions prior to DirectAdmin 1.44.0 are vulnerable.
DirectAdmin is prone to multiple security vulnerabilities. These include an arbitrary file-access vulnerability, multiple arbitrary-file-overwrite vulnerabilities and a privilege-escalation vulnerability.
An attacker can exploit these issues to execute arbitrary commands with root privileges, read arbitrary files or overwrite arbitrary files in the context of the user running the affected application. This may aid in further attacks.
Versions prior to DirectAdmin 1.44.0 are vulnerable.
Exploit / POC
DirectAdmin Backup Multiple Security Vulnerabilities
A local attacker can exploit these issues using readily available tools.
A local attacker can exploit these issues using readily available tools.
Solution / Fix
DirectAdmin Backup Multiple Security Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
DirectAdmin Backup Multiple Security Vulnerabilities
References:
References:
- DirectAdmin 1.44.0 has been released (JBMC Software)
- DirectAdmin �?? Arbitrary File Access Vulnerability (R911-0077) (Rack911)
- DirectAdmin �?? Arbitrary File Overwrite Vulnerability (R911-0075) (Rack911)
- DirectAdmin �?? Arbitrary File Overwrite Vulnerability (R911-0076) (Rack911)
- DirectAdmin �?? MySQL Local Privilege Escalation Vulnerability (R911-0078) (Rack911)
- DirectAdmin Homepage (JBMC Software)
- Security: improvements to strict_backup_permissions - MAJOR CHANGES (JBMC Software)
- Version 1.44 (JBMC Software)