Security hole in ISPCP 1.0.5

[joximu]

Well - if /var/log *is* destroyed then someone needs root privileges.

But with root privileges you do not need to create ftp users in the panel...

So there were maybe two incidents???

Finding an ispcp login password should only be possible with/by sniffing or social engineering (or try and error - if you have the hash).

Reading the ispcp-login-hash needs access to the ispcp database - which needs a mysql root-privileged account...

Indeed very strange what happened here...

/J