Current time: 06-19-2018, 02:30 PM Hello There, Guest! (LoginRegister)


Post Reply 
Security Announcement: Backup Restore Manager
Author Message
RatS Offline
Project Leader
******

Posts: 1,854
Joined: Oct 2006
Reputation: 17
Post: #1
Security Announcement: Backup Restore Manager
Today another critical security issue has been found. All ispCP Omega versions are effected.
It is possible to use the ispCP Client Backup Manager to restore forged backups and - in worst case - gain control over the server system.

We strongly recommend to fix the described security issue by disabling the backup restore routine. For this open the ispcp-dmn-mngr in /var/www/ispcp/engine/ and search for

Code:
sub dmn_restore_data {

add
Code:
exit 1;

directly in the next line.

We try to deliver a patch as fast as possible. You can follow the status in ticket: 2440
08-30-2010 01:23 AM
Visit this user's website Find all posts by this user Quote this message in a reply
RatS Offline
Project Leader
******

Posts: 1,854
Joined: Oct 2006
Reputation: 17
Post: #2
RE: Security Announcement: Backup Restore Manager
We have fixed the ispCP security issue discovered this week. For your
convenience we are releasing a patch against ispCP Omega 1.0.6 and will
also work with version 1.0.5.

It is strongly advised that you apply the patch. Remember to
delete the "exit 1;" command after "sub dmn_restore_data {".

After the patch has been applied successfully, run the backup manager to
change the permission of all backup folders and files to read only for
all users except the root user. To run the backup manager type the
following command in your server command line:

Code:
/var/www/ispcp/engine/backup/ispcp-backup-all yes

Please visit Ticket #2440 for more information.
08-31-2010 08:51 AM
Visit this user's website Find all posts by this user Quote this message in a reply
Post Reply 


Forum Jump:


User(s) browsing this thread: 1 Guest(s)