Security Announcement: Backup Restore Manager

[RatS]

Today another critical security issue has been found. All ispCP Omega versions are effected.
It is possible to use the ispCP Client Backup Manager to restore forged backups and - in worst case - gain control over the server system.

We strongly recommend to fix the described security issue by disabling the backup restore routine. For this open the ispcp-dmn-mngr in /var/www/ispcp/engine/ and search for

Code:

sub dmn_restore_data {

add

Code:

exit 1;

directly in the next line.

We try to deliver a patch as fast as possible. You can follow the status in ticket: 2440