update to cPanel 9.4.0 build 10 STABLE

[gorilla]

Hi,
when is the STABLE update to cPanel 9.4.0 build 10 going to be available ?

 

[rs-freddo]

I think cPanel is still working pretty hard to fix the mess they made. If you are running phpsuexec you are not vulnerable and there is no need to upgrade - shame the big red text doesn't say that eh...

 

[mickalo]

Originally posted by rs-freddo
I think cPanel is still working pretty hard to fix the mess they made. If you are running phpsuexec you are not vulnerable and there is no need to upgrade - shame the big red text doesn't say that eh...

right you are. we've been running the most recent STABLE tree w/PHPsuexec and Suexec with no problems for sometime.

With Phpsuexec enabled, this disables the mod_php apache module which should take care of the security problem.

Mickalo

 

[gorilla]

Upgraded apache when I saw the message in WHM as well and got the same issues like everybody else about the broken links for /cpanel and /webmail
and after waiting for a new STABLE release I had two choices to fix this problem .
Upgrade to an unstable EDGE release ( which seems to bring even more problems ) or just disable suexec .
So i just disabled suexec and the links are all working fine again .
Any feed back from you guys regarding disabling suexec ?

 

[Jeff-C]

Any feed back from you guys regarding disabling suexec ?

Well, obviously you are now more vulnerable to poorly written exploitable cgi perl scripts or malicious users, but other than that

 

[Sinewy]

ive got suexec disabled no security issues at all.

i run on RELEASE or CURRENT. i grab the one which is the more up to date.

 

[Angel78]

Originally posted by Sinewy
ive got suexec disabled no security issues at all.

Do you mean this like, no there are no security issues at all when you disable suexec (I think that you are wrong)

or

I havent faced any security issues since I have disabled suexec ?

 

[gorilla]

So what exactly are the security issues ?
Are the external or internal ?
Is it easier for a hacker to compromise the system externally if suexec is disabled ? Or are you just pointing out that our hosting clients are able to run cgi with the 'nobody' Id ?