Type: Arbitrary File Access
Location: Remote
Impact: Medium
Product: cPanel
Website: http://www.cpanel.net
Vulnerable Version: All versions prior to the fixed builds below.
Fixed Version: 11.40.1.3, 11.40.0.29, 11.38.2.13 & 11.36.2.10
CVE: -
R911: 0101
Date: 2013-12-18
By: Rack911
Product Description:

cPanel is an easy-to-use control panel that gives web hosts and the website owners they serve, the ability to quickly and easily manage their servers and websites. Web Host Manager (WHM) is a part of the cPanel software, often used by resellers and system administrators.

Vulnerability Description:

A malicious reseller can manipulate named (BIND) to open any file on the server, including root owned files, with the possibility of being able to view sensitive data.

Impact:

We have deemed this vulnerability to be rated as MEDIUM due to the fact that while any file can be accessed, the output is extremely limited making this exploit difficult to perform.

Vulnerable Version:

This vulnerability was tested against cPanel 11.40.0.9 and is believed to exist in all versions prior to the fixed builds below.

Fixed Version:

This vulnerability was patched in cPanel 11.40.1.3, 11.40.0.29, 11.38.2.13 & 11.36.2.10.

Vendor Contact Timeline:

2013-10-04: Vendor contacted via email.
2013-10-10: Vendor confirms vulnerability.
2013-12-16: Vendor issues updates to all builds.
2013-12-18: Rack911 issues security advisory.