The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

cPanel TSR-2015-0001 Full Disclosure

Discussion in 'cPanel Announcements' started by cPanelCory, Jan 20, 2015.

  1. cPanelCory

    cPanelCory Developer - cPanel Security Team
    Staff Member

    Joined:
    Jan 18, 2008
    Messages:
    69
    Likes Received:
    5
    Trophy Points:
    8
    Location:
    Houston
    cPanel Access Level:
    Root Administrator
    cPanel TSR-2015-0001 Full Disclosure

    SEC-1

    Summary

    Arbitrary code could be executed as other accounts with RUID2/ITK enabled.

    Security Rating

    cPanel has assigned this vulnerability a CVSSv2 score of 4.9 (AV:N/AC:M/Au:S/C:P/I:P/A:N)

    Description

    The WHM "Apache mod_userdir Tweak" interface incorrectly allowed the exclusion of specific users from userdir protection when mod_ruid2 or MPM-ITK was in use on the server. With this misconfiguration, the excluded user could execute arbitrary code with the UID and GID of the excluding virtualhost via Apache userdir URLs.

    Credits

    This issue was discovered by the cPanel Security Team.

    Solution

    This issue is resolved in the following builds:
    11.46.2.2
    11.46.1.6
    11.44.2.4
    11.42.1.30

    SEC-4

    Summary

    Noshell restriction bypass via SFTP connections.

    Security Rating

    cPanel has assigned this vulnerability a CVSSv2 score of 2.1 (AV:N/AC:H/Au:S/C:N/I:P/A:N)

    Description

    On cPanel & WHM systems, accounts configured with "noshell" as their login shell may still connect to the server using SFTP. Users connecting in this fashion had access to the /proc filesystem. By modifying '/proc/self/mem', an attacker could execute arbitrary code as if connected via a normal shell.

    Credits

    This issue was discovered by Jann Horn.

    Solution

    This issue is resolved in the following builds:
    11.46.2.2
    11.46.1.6
    11.44.2.4
    11.42.1.30

    SEC-8

    Summary

    Stored XSS vulnerability in cPDAVd directory index functionality.

    Security Rating

    cPanel has assigned this vulnerability a CVSSv2 score of 3.5 (AV:N/AC:M/Au:S/C:N/I:P/A:N)

    Description

    cPDAVd did not correctly HTML escape filenames included in the HTML it generated for directory indexes. This allowed attackers with the ability to generate files with XSS payloads to conduce stored-XSS attacks against the authenticated cPDAVd user if the user connected with to WebDAV services using a normal web browser.

    Credits

    This issue was discovered by the cPanel Security Team.

    Solution

    This issue is resolved in the following builds:
    11.46.2.2
    11.46.1.6
    11.44.2.4
    11.42.1.30

    For the PGP-signed message, see http://cpanel.net/wp-content/uploads/2015/01/TSR-2015-0001-Full-Disclosure.txt.
     
    #1 cPanelCory, Jan 20, 2015
    Last edited: Jul 20, 2015
Loading...

Share This Page