cPanel Login Command Injection Vulnerability

[WCW Fan]

is this fixed in the latest stable version ?

[casey]

Originally posted by WCW Fan
is this fixed in the latest stable version ?

No cpanel servers should be vulnerable to this anymore. Cpanel themselves hacked those that were in order to patch them.

[Curious Too]

Originally posted by Domenico
EDIT: this is not about the 'lost password' hack! Read carefully...

But it is old news. This exploit was posted and patched along with the "lost password" hack.

[oldengine]

This has been patched in latest forced update

Does it take too much effort to refer to the "latest update" by its number? There are THREE versions EDGE, RELEASE and STABLE, each with numbers that appear in the upper right hand corner. It would be a lot simpler to use them rather than having to poke around to find out what the LATEST is as of when.

[zex]

I think that people on this forum deserve that cpanel officaly say to us wich version are secure and wich are not.

I had before day's rootkit and I spend hell-weekend just becouse I didn't know that there is autorootkit for cpanel.
I think that in any case custumers have right to know about all problems, If we continue to keep things just for our selves, and not share information we may just forgot about security and give keys of our servers to people who know better than us wich version are vurnelable or wich software have bugs.

[cpanelnick]

Originally posted by zex
I think that people on this forum deserve that cpanel officaly say to us wich version are secure and wich are not.

I had before day's rootkit and I spend hell-weekend just becouse I didn't know that there is autorootkit for cpanel.
I think that in any case custumers have right to know about all problems, If we continue to keep things just for our selves, and not share information we may just forgot about security and give keys of our servers to people who know better than us wich version are vurnelable or wich software have bugs.

8.6.0build31 though 9.1.0build40 are the builds with the security problems.

[zex]

Thank you for fast replay. This is very helpful.

[trakwebster]

Originally posted by zex
... <snip> ... didn't know that there is autorootkit for cpanel ... <snip> ...

Uh, autorootkit?

What is autorootkit?

[dasher]

1) Yes this is fixed
2) Are you so damn stupid that you are going to post HOW TO DO A HACK INTO A PUBLIC FORUM!?!?!?!? /me shakes head... another dumbass

Please don't be a dumb ass!
Security through obscurity isn't.

The information is public domain already. And telling Admins how to test to see if their own system in vulerable - is an important way for them to check the vendor has fixed the problem.


Dasher

[dasher]

#1 you are about as dense as them. LOOK AT THE DATE ON THIS
#2 Try to think before posting, it cant be that hard to do

Is there a date on a principle?
I was referring to the general principle of full disclosure.

Your rule #2 applies...