Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Altered RPM Notice - cpanel-roundcubemail

Discussion in 'General Discussion' started by MH-Stefan, Nov 22, 2016.

Tags:
  1. MH-Stefan

    MH-Stefan Member

    Joined:
    Dec 3, 2013
    Messages:
    16
    Likes Received:
    2
    Trophy Points:
    3
    cPanel Access Level:
    Root Administrator
    Since about 2 weeks, we're getting the following notification from all servers on a daily basis:

    Running the "check_cpanel_rpms --fix" command fixes the RPMs, but the next day the RPM breaks again.

    This happens on old servers, as well as on freshly deployed servers. All servers run the latest cPanel version, currently 60.0 (build 25).

    Is this a known bug? Is there any permanent fix for this available?

    Thank you in advance.
     
    #1 MH-Stefan, Nov 22, 2016
  2. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    42,734
    Likes Received:
    1,706
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello,

    The cPanel RPM check script detects changes to files included as part of the Roundcube package. Do you have any third-party plugins or cron jobs that are automatically modifying the "/usr/local/cpanel/base/3rdparty/roundcube/skins/larry/includes/footer.html" file on the system?

    Thank you.
     
    #2 cPanelMichael, Nov 23, 2016
  3. MH-Stefan

    MH-Stefan Member

    Joined:
    Dec 3, 2013
    Messages:
    16
    Likes Received:
    2
    Trophy Points:
    3
    cPanel Access Level:
    Root Administrator
    Hello,

    Thanks for the reply.

    We have some WHM plugins installed, but none related to Webmail and nothing that would modify that specific file. At least not on purpose.

    This even happened on a server that has only the ConfigServer plugins installed. I doubt that these would touch that file.
     
    #3 MH-Stefan, Nov 23, 2016
  4. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    42,734
    Likes Received:
    1,706
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello,

    Are you using the Attracta plugin? I've seen an additional report about this plugin making the change to the same file. You may want to report this issue to their support team to ensure it's corrected.

    Thank you.
     
    #4 cPanelMichael, Nov 29, 2016
  5. 4u123

    4u123 Well-Known Member
    PartnerNOC

    Joined:
    Jan 2, 2006
    Messages:
    832
    Likes Received:
    12
    Trophy Points:
    168
    I'm having this same problem - just started a few days ago after the recent cpanel update to 62.0.10. Why would Attracta make changes to Roundcube I wonder? That's pretty suspicious. Did you contact Attracta MH-Stefan?
     
    #5 4u123, Feb 15, 2017
  6. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    42,734
    Likes Received:
    1,706
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello @4u123,

    Audit logs on systems with Attracta installed do suggest Attracta is making changes to the /usr/local/cpanel/base/3rdparty/roundcube/skins/larry/includes/footer.html file. I haven't seen an indication their support team has been contacted about this topic by anyone on this thread, so you may want to submit a request to them if you are using Attracta and notice this issue:

    Knowledge base | Attracta

    Thank you.
     
    #6 cPanelMichael, Feb 15, 2017
  7. MH-Stefan

    MH-Stefan Member

    Joined:
    Dec 3, 2013
    Messages:
    16
    Likes Received:
    2
    Trophy Points:
    3
    cPanel Access Level:
    Root Administrator
    I've reported this bug on Monday and got the following response:

     
    #7 MH-Stefan, Feb 18, 2017
    MDHMatt and cPanelMichael like this.
  8. MDHMatt

    MDHMatt Registered

    Joined:
    Dec 31, 2016
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    UK
    cPanel Access Level:
    Reseller Owner
    Have you heard anything more from them like when they will be bringing out a patched update?

    And does it return if you remove those lines manually?
     
    #8 MDHMatt, Mar 7, 2017
  9. MH-Stefan

    MH-Stefan Member

    Joined:
    Dec 3, 2013
    Messages:
    16
    Likes Received:
    2
    Trophy Points:
    3
    cPanel Access Level:
    Root Administrator
    I didn't get any further reply. I simply decided to uninstall the plugin from all our servers, as I'm not aware of any of our clients using it.

    You could email their support team and see if the plugin was updated. Maybe if they get more reports, they'll set a higher priority for this bug.
     
    #9 MH-Stefan, Mar 7, 2017
(You must log in or sign up to post here.)
Loading...
Similar Threads - Altered Notice cpanel
  1. Sudofox

    Altered RPMs notice from cPanel servers after CVE patch

    Sudofox, May 10, 2016, in forum: General Discussion
    Replies:
    3
    Views:
    934
    Sudofox
    Jun 3, 2016
  2. carock

    Altered RPMs found - easy-basesystem

    carock, Feb 9, 2018, in forum: General Discussion
    Replies:
    2
    Views:
    117
    carock
    Feb 9, 2018
  3. crshep

    [check_cpanel_rpms] Altered RPMs found on

    crshep, May 30, 2016, in forum: General Discussion
    Replies:
    2
    Views:
    825
    crshep
    May 30, 2016
  4. garconcn

    Get Altered RPMs found warning after patch CVE-2016-3714 ImageMagick

    garconcn, May 6, 2016, in forum: General Discussion
    Replies:
    1
    Views:
    674
    cPanelMichael
    May 6, 2016
  5. Barry Su

    LFD Notice of Suspicious Process

    Barry Su, Mar 24, 2018, in forum: Security
    Replies:
    2
    Views:
    88
    cPanelMichael
    Mar 26, 2018

Share This Page