ispCP Omega 1.0.5 Security Announcement II

[RatS]

Dear all,

Today we discovered another potential fault, this time in the ispCP Omega Engine. This security fix only affects installations where DEBUG is switched on in ispcp.conf. By default this functionality is disabled, if you have not enabled it then this security announcement does not affect you.

The details of the security fix are, on Database backup the password for the ispCP database user is revealed and logged in clear text without obfuscation.

To secure your installation, it is recommended to either set DEBUG to 0 or use the
patch attached to ticket 2411.

We apologise for any inconvenience caused.