dennis0162
07/10/13, 16:46
Als je nog niet geupdate hebt naar DirectAdmin versie 1.44 (26-9-2013), dan is het aan te raden om dat te doen:
Product Description:
DirectAdmin is a graphical web-based web hosting control panel designed to make administration of websites easier.
Vulnerability Description:
There is a flaw within the backup system that allows an attacker to rub arbitrary commands while restoring MySQL databases as root that could ultimately lead to a root compromise.
Proof of Concept:
Due to the nature of this security flaw, we will not be posting a Proof of Concept until a much later date.
Impact:
We have deemed this vulnerability to be rated as CRITICAL due to the fact that a normal user can gain an instant root shell.
Vulnerable Version:
This vulnerability was tested against DirectAdmin v1.43 and is believed to exist in all prior versions.
Fixed Version:
This vulnerability was patched in DirectAdmin v1.44.
Vendor Contact Timeline:
2013-06-22: Vendor contacted via email.
2013-06-22: Vendor confirms vulnerability.
2013-09-26: Vendor issues v1.44 update.
2013-10-07: Rack911 issues security advisory.
Zie ook: http://www.directadmin.com/features.php?id=1480
Product Description:
DirectAdmin is a graphical web-based web hosting control panel designed to make administration of websites easier.
Vulnerability Description:
There is a flaw within the backup system that allows an attacker to rub arbitrary commands while restoring MySQL databases as root that could ultimately lead to a root compromise.
Proof of Concept:
Due to the nature of this security flaw, we will not be posting a Proof of Concept until a much later date.
Impact:
We have deemed this vulnerability to be rated as CRITICAL due to the fact that a normal user can gain an instant root shell.
Vulnerable Version:
This vulnerability was tested against DirectAdmin v1.43 and is believed to exist in all prior versions.
Fixed Version:
This vulnerability was patched in DirectAdmin v1.44.
Vendor Contact Timeline:
2013-06-22: Vendor contacted via email.
2013-06-22: Vendor confirms vulnerability.
2013-09-26: Vendor issues v1.44 update.
2013-10-07: Rack911 issues security advisory.
Zie ook: http://www.directadmin.com/features.php?id=1480