Security warning to all hosting providers [Merged]

[Decker]

Settle - there are a few issues with this report. Don't get heated.

 

[dmaxwell]

cPanel Could Be Hacked Worldwide

From Clubhostcity.com Forums

Posted: Admin @ Sat Feb 25, 2006 2:15 pm

There is no more "File Manager" on any web hosting accounts
and that includes both PAID and FREE web hosting accounts !!!!!

Last week, a bug was discovered in the File Manager system that prevented anyone from creating new folders which is little more than an annoyance and nothing more.

Meanwhile, the bug in the new Cpanel version and their delay in getting out a fix for the problem caused us to do our own research into the issue to see if we could fix it ourselves.

Instead of finding a problem to the file creation bug, we instead accidentally discovered a massively enormous security problem with the file manager! We discovered a way to edit any files, on any web hosting account, at any service provider running Cpanel WITHOUT THE NEED TO LOGIN TO THE ACCOUNT !!!!!

Basically in a nutshell, we have discovered a way to hack every single Cpanel hosting account on the planet since everyone has the file manager feature enabled on their hosting services !!!!!

Based on this new discovery and coupled with the other unrelated bug, we are discontining support for the FILE MANAGER feature at Clubhost City for security reasons.

 

[ChangAdam]

lol it's he's first post...wierd eh? warning us....

 

[=dan=]

u mean the file manager on the newest cpanel verison or all...and wtf? wow..nice find

 

[Decker]

We all know that there are security probs - take it with a pinch of

 

[Johnson]

Yes, just tell everyone.

 

[nex-gen host]

does this only affect the latest latest cpanel update? If so, surely it makes sense to simply downgrade.

 

[kb3mol]

We should all send mass emails to cpanel until the fix the mess, what a terrible bug to have, get into the root and do damage

 

[amz]

I'll confirm that the fear mongering going on here is valid. There is a security hole when using the HTML Editor in cPanel.

Exploit is not a serious issue for us - we use phpsuexec - so you can't access the files. Listing is prevented by mod_security.

LP-Trel and Craig are both heading up the correct direction but are both
apparently unaware of another separate problem that is very closely
related to the known HTML Editor security problem mentioned above
and is another aspect of it that fortunately seems to be missed by
most people at this point ... very fortunately!

We can confirm the security hole being reported in this thread as we
know precisely what the exploit is and also how to use it. I will say
that it does not matter whether you have phpSuExec enabled or not
for this one although phpSuExec would help with logging the attacks ....

I'm not going to say anything more than what has already been said
because I do not want to tell all the hackers of the world precisely
what they need to do to hack all the Cpanel servers.

I'm sure that Cpanel will probably have a fix out for the problem soon
since this one would obviously register as a very high priority.

 

[nex-gen host]

Yes, you would have thought they would have noticed by version 10.

 

[Daniel]

Who uses the file manager?

My paid host disables the file manager, simply because FTP is a much more easier, faster, and more powerful way of doing things.

 

[Canuckkev]

I call BS.

 

[Decker]

Having had a reliable source inform me that this is not just a pile of! Makes good reason to take the warning.

Double check folks.

I know it's going back on myself but - well I was wrong so I was wrong

 

[Tree]

I second that.

Although it is possible, it's not plausable that while CHC was looking around the cPanel source they found a huge security hole.

Show me a cPanel it's happened to and I'll believe it.

 

[Trel]

LP - good tip for the dodgy bits LOL

I don't quite understand.

LP-Trel and Craig are both heading up the correct direction but are both
apparently unaware of another separate problem that is very closely
related to the known HTML Editor security problem mentioned above
and is another aspect of it that fortunately seems to be missed by
most people at this point ... very fortunately!

Yet another reason why the kill the fly with a bazooka approach works well sometimes.

 

[amz]

Yet another reason why the kill the fly with a bazooka approach works well sometimes.

Indeed!

 

[peace_hope]

Sounds like complete BS...

Let me tell you what I think happened:

The supposed hosting company that you got that info from, well look at it, it does not even look like a hosting company. I think that the person who runs that site used to have a reseller account and could create other sub-accounts on the reseller account, and for some reason the person they were getting their reseller from either went out of business or they decided to drop this account due to overselling maybe?

And now this person has just a basic hosting account with who ever is hosting their website, and they now realize that they cannot offer additional cpanel accounts to anyone else, but however they have unlimited ftp accounts, therefore they can offer space because they can just create a new ftp account, and call it a hosting account.

That is what I think happened, therefore complete BS.

One way to find out for sure is if anyone has upgraded to the latest cpanel, go into it and use your file manager, see if you can create a new folder or not, if not then this is possibly legit, if you can then this just re-enforces how screwed up this is.

Thanks for listening,

Peace_Hope
Alexander

 

[veggie1232]

lol ahahah ya true true

 

[Tree]

Peace_hope,

Nowhere in your incoherent ramblings did you even come close to anything that could be considered a rational thought. Everyone in this forum is now dumber after reading it. I award you no points, and may God have mercy on your soul.

 

[hottweelz]

Peace_hope,

Nowhere in your incoherent ramblings did you even come close to anything that could be considered a rational thought. Everyone in this forum is now dumber after reading it. I award you no points, and may God have mercy on your soul.

The part of the story I don't like, is that the boy stops looking for his dog after an hour. He just sits on his porch like a goon, he didn't put up posters or anything. That boy's gotta think "You got a pet, you got a responsibility! You can't just look for an hour and call it quits. So you get your --- out there and you find that ----in' dog!"