cPanel releases security patches for 20 critical vulnerabilities

The cPanel security team has identified several security concerns in their control panel software. They have also released patches to address all these security concerns with the cPanel and WHM product. This patch basically addresses 20 vulnerabilities in cPanel & WHM software versions 11.54, 11.52, 11.50, and 11.48. The patches include following vulnerability fix

1.  Arbitrary code execution via unsafe @INC path.
2. SQL injection vulnerability in bin/horde_update_usernames.
3. Arbitrary code execution vulnerability during locale duplication.
4. Password hashes revealed by bin/mkvhostspasswd script.
5. Limited arbitrary file read in bin/setup_global_spam_filter.pl.
6. Code execution as shared users via JSON-API.
7. Password hash revealed by chcpass script.
8. Arbitrary file overwrite in scripts/check_system_storable.
9. Arbitrary file chown/chmod during Roundcube database conversions.
10. Arbitrary file read and write via scripts/fixmailboxpath.
11. Arbitrary file overwrite in scripts/quotacheck.
12. Limited arbitrary file chmod in scripts/secureit.
13. Arbitrary code execution via scripts/synccpaddonswithsqlhost.
14. Self-XSS in WHM PHP Configuration editor interface.
15. Missing ACL enforcement in AppConfig subsystem.
16. Stored XSS in WHM Feature Manager interface.
17. Self-XSS in X3 Entropy Banner interface.
18. Unauthenticated arbitrary code execution via cpsrvd.

For more details regarding this announcement, please check the following article:

https://forums.cpanel.net/threads/cpanel-tsr-2016-0001-announcement.520741/

How do you update the cPanel version?

1. WHM interface : You can update the cPanel version from WHM panel through the following steps :-

• Login to WHM panel
• Click on cPanel
• Click on Update to Latest version
• Click on “Click to Upgrade” and proceed accordingly

2. Command line interface (CLI) :- You can update the cPanel version through CLI by accessing the server via SSH and running the following command :-

#/scripts/upcp –force

We are working on the technical details on the some of the vulnerability, we will share as soon as possible.

Till then Stay Safe! Stay Secure!