Slashdot Mirror
cPanel Exploit Used to Circulate IE Exploit
miller60 writes "In a dangerous combination of unpatched exploits, hackers have used a previously undiscovered security hole in cPanel to hack the servers of a hosting company and use hundreds of hijacked sites to infect Internet Explorer users with malware using the unpatched VML exploit. cPanel, whose hosting automation software is used by many large hosting companies, has issued a fix. It's a local exploit, meaning the attacker must control a cPanel account on the target hosting provider."
Sure there are places where you'll get attacked often and there are others which are unlikely to be compromised but it's not enough in itself to just avoid places that look suspicious.
the more they over-think the plumbing the easier it is to stop up the pipe
Actually, cPanel does run in Linux. But it's Perl, so it doesn't count.
Please, for the good of Humanity, vote Obama.
This Windows exploit is similar to the WMF exploit, and just like it, Microsoft is going to take their time fixing it. If you must use Windows avoid IE and Outlook but that's not always possible.
.dll as follows...
And to be completely safe you can unregister the
Copy the following command to clipboard and Paste into Run:
regsvr32 -u "%CommonProgramFiles%\Microsoft Shared\VGX\vgx.dll"
Then when Microsoft gets around to fixing this (Probably on the next patch Tuesday) you can restore it:
regsvr32 "%CommonProgramFiles%\Microsoft Shared\VGX\vgx.dll"
Want to bet this code is in Vista somewhere?
"Kittens give Morbo gas!"
As always it should be pretty well known that a number of large shared hosting providers have little or no security to prevent this kind of stuff. Using a cPanel local exploit to start putting the IE exploit code in other users' www folders is an interesting use for the 0-day find. A number of larger hosting providers house dozens, hundreds, and sometimes more websites on a boxes that allow FTP and in some cases telnet. These boxes generally aren't patched very well either and can easily be rooted to allow someone to drop their bad code into * the hosted sites webpages. It's been said 1000 times before, but even if you choose to run IE -- if you're not running as an Administrator (or you even use something like DropMyRights to run IE) there's probably a 99% chance the IE exploit won't do anything. The same goes for Mozilla/Firefox and any other program on Windows.
I don't know anything about cPanel- I'll gladly take your word on it, but I was more focused on the IE vector of attack, yet again.
An exploit using cPanel to attack IE on my *nix boxes is gonna be one confused, helpless puppy!
Down With Slashdot BETA!!! I've been around the corner and seen the oliphant; you can only abuse me from your perspecti
If you admin a server with cPanel, run /scripts/upcp to apply the patch.
Otherwise, so long as you have not turned off the nightly UPCP update, then your server will be patched overnight tonight automatically.
Slashdot in 5 Paragraphs
As usual, the problem is all M$. The fact that the attacker must have an account to break cPanel is more a mitigating factor than what language cPanel was written in. Now, if you are dumb enough to be administering your site through Windoze, you might have already given away that access by keylogger. There's an endless supply of drive by hijackings for that OS. A malicious interested party in Redmond might hire someone to conduct just such an attack to make visiting Linux hosted sites the kiss of death. That would be a lot of work for very little return, as hosting sites will patch, but it just goes to show that security is only as good as your weakest link.
Friends don't help friends install M$ junk.
We know they discovered the cpanel root exploit about a month earlier before launching this. They were waiting for the perfect timing before having sites load an iframe distributing the viruses. The perfect timing became the new vml exploit. It wasn't easy to figure out how they were doing it but we did. Shortly after we discovered how which was the 0 day cpanel root exploit. Upon investigating it further we found any hosting company in the world running cpanel could be exploited. In fact we spoke with some other very large hosting companies that were. One that's even much larger then us, and has been around much longer. I'd like to thank everyone that was helping us track down the root cause. Special thanks to David Collins, Tim Greer, Brad, Idefense.com, and the other hosting companies who cooperated with us once we alerted them.
People have been exploiting CPanel bugs to compromise shared hosting for the purposes of hosting clientside (IE) exploit code for ages - this isn't new. The first time I know of for a fact was 2 or more years ago. For as many large providers as use CPanel, the code really needs to be more closely audited...
Discussion on the hosting company's (HostGator) support forum: http://forums.hostgator.com/showthread.php?t=10928
cPanel does run in Linux, but the Perl comment was a mistake(something I thought I had heard). It's still proprietary, though, and running important things on proprietary software is by default a liability.
Please, for the good of Humanity, vote Obama.
True: IE is still the vector of attack. Which isn't surprising--using IE as a web browser is the internet equivalent of unprotected sex with a crack whore.
Please, for the good of Humanity, vote Obama.
Damn.
There's a lot of people out there having unprotected sex with a crack whore!
Karnal
Web hosting companies should use everything custom-coded and not rely on third-party scripts anyway. I host at Yellowpipe Hosting.
It does not really minimize the risk for errors, but at least it prevents exploits from spreading on the Internet.
This is Matt Heaton, President of Bluehost.com. We were working with Brent at Hostgator and had issued a fix before Cpanel finally got around to doing so. There are STILL multiple root exploits that we know FOR SURE work on Cpanel that have yet to be fixed. In one case it is a simple one liner that will pop root on any Cpanel install. This still works even after their "patch". Security is always an afterthought for the Cpanel guys and never designed in as it should be from the start. We were happy that Hostgator asked us for help as we were happy to help and would hope that they would do the same for us if need be. Don't blame the hosting companies in this case, blame Cpanel for knowing about their multitude of scripts that run with root priviledges without properly parsing all data passed to and from their suid c programs!! We have been complaining about this for at least 2 years with little or no help for the issue. We have at least 20 bandaids for Cpanels scripts to fix problems that they refuse to deal with in their "stable" and "current" versions. Hopefully this incident will help them to move in the right direction, but given past exploits and their "resolutions" I HIGHLY doubt ti!
So well first we have a web browser with well established history of being crappy and insecure. Thousands of exploits, hundreds of successful global scale exploits attacking Microsoft Internet Explorer. Product well known to be one of least secure of probably all of software products. The king of insecurity - MSIE (with Windows underneath - but you can't have it otherwise, consider MSIE for Mac dead).
Secondly we have some closed source software called cPanel. An ugly hack on system administration, you know the one that gives you root-like privileges over WWW. I don't know cPanel record of security but I don't care really - closed source, and unusefull (to me) stuff.
So you are using MSIE and clicking in some web frontend to administer other system. And you thought it was secure? Why?
How do I check if my host's cPanel is fixed without logging in & handing them my password?
I mean, I could contact my hosting provider, but I would prefer to check before harassing them.
Also, as good as they've been, I haven't really tested their professionalism before. I'd like to check w/o logging in, whether or not they say they've installed the patch. Is this remotely feasible?
There are no trails. There are no trees out here.
Maybe this will convince shitty webhosts that are clueless to quit using cpanel and the rest of those "lets let everyone have root and pretend its secure" admin tools. Or at least convince people to switch away from incompetant morons like you and to decent webhosts.
there exists plesk as well.
Exactly right... any one who runs cpanel deserves to be hacked!
I don't know if this is related, but I hit a webpage today that tried to access my router at 192.168.1.1.
My router's password dialog appears when hitting the page.
I don't think I've seen that one before.
cPanel = cracker panel
Still doesn't make it right, or smart.
--Phillip
Can you say BIRTH TAX
If what you say is true then about 90% of all shared host web sites are at risk. Presumably now that it is a public fact that cPanel is crawling with security holes the black hats will be actively looking for the exploits.
Brent with hostgator.com here again. We have just discovered cpanels patch /scripts/upcp doesn't do anything. If you think you were autopatched last night or ran upcp your still very hackable.
What you need to do is run /scripts/upcp --force
A way to confirm our findings is to run http://layer2.cpanel.net/installer/sec092306.pl which is their patch checker. If your not safe it will say "not safe" if your safe it will say "safe"
After all this even after running and being told "safe" I don't believe it's truly fixed. We'll all be very lucky if something doesn't spawn off this or another cpanel wrapper exploit doesn't hit the market.
Cpanel please provide us with some source so we can help you audit. We're not asking for all of it just parts that we know aren't secure such as wrapper.
So basically any hosting company that allows people access to a demo of cPanel would be affected. Yikes. From what I've seen that's quite a few.
When shit hits the fan get some of these https://youtu.be/pY-GncsZ-UE
I think hostprince.com has been affected too - I keep a personal links page there and a fresh PC got infected last night, which is a very rare occurrence for me. They seem to have disabled cpanel access as well.
In bizzaro world, that's exactly what's happening...
Dipshits fuck crackwhores, and spread the myth that it's safe to have unprotected anal with a crackwhore to their friends, who are also fucking the crackwhore with no rubber, until it becomes the norm. Crackhead fuckers become so used to their friends dropping dead that they start to become accustomed to people dying for no apparent reason.
The only people who aren't dropping like flies are the 2% of people who kept using regular non-crack addicted whores, and kept using rubbers. The crackwhore fuckers are swallowing antiviral and antibiotic pills and still getting infections, if only they'd kept themselves clean in the first place they wouldn't have these problems.
If only they hadn't followed each other like lambs to the slaughter, if only they'd had an original thought in their lives. But no, the crackwhore fuckers all wanted to be able to fuck their whores up the ass like their friends did, and only crackwhores are stupid and desperate enough, and stock tubes of diRectumX 9 lubricant to allow that.
Only in Bizzaro world would people keep going back to something that gave them infection after infection....