(Apr 7) Security Report Summary
Comment
Archive for April 8th, 2014
11 results.
(Apr 7) OpenSSL could be made to expose sensitive information over the network,possibly including private keys.
(Apr 7) USN-2124-1 introduced a regression in OpenJDK 6.
Red Hat: 2014:0376-01: openssl: Important Advisory
Apr08
on April 8, 2014
at 11:36 pm
Posted In: Uncategorized
(Apr 7) Updated openssl packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having [More…]
As teased earlier, the first release candidate for WordPress 3.9 is now available for testing! We hope to ship WordPress 3.9 next week, but we need your help to get there. If you haven’t tested 3.9 yet, there’s no time like the present. (Please, not on a production site, unless you’re adventurous.) To test WordPress 3.9 […]
WordPress 3.8.2 is now available. This is an important security release for all previous versions and we strongly encourage you to update your sites immediately. This releases fixes a weakness that could let an attacker force their way into your site by forging authentication cookies. This was discovered and fixed by Jon Cave of the WordPress […]
Half a million widely trusted websites vulnerable to Heartbleed bug
Apr08
on April 8, 2014
at 3:22 pm
Posted In: Uncategorized
A serious overrun vulnerability in the
OpenSSL cryptographic library affects around 17% of SSL web servers which use certificates issued by trusted certificate authorities. Already commonly known as the
Heartbleed bug, a missing bounds check in the handling of the TLS heartbeat extension can allow remote attackers to view up to 64 kilobytes of memory on an […]
SUMMARY cPanel, Inc. has released EasyApache 3.24.15 with FCGI version 2.3.9 and PHP versions 5.5.10 and 5.4.27. This release addresses the FCGI vulnerability CVE-2013-4365 with fixes to a possible heap buffer overwrite issue, and the PHP vulnerability CVE-2013-7345 with fixes to bugs in the fileinfo module. We encourage all FCGI …
What’s Changed
[+] Service nodes can be deployed on CloudLinux.
[+] A new utility, called sync_resource_usage, is available for synchronizing information about resource usage between the Server Administration Panel and Hosting Panel.
[+] The hostname utility can update the host names of service nodes in PPA.
[+] During migration from Plesk or Plesk Expand to PPA 11.5, providers can keep their existing SmarterMail servers and connect them to PPA as service nodes.
[*] Migration of a large number of sites now takes less time.
[*] The stability of the migration tool was improved.
[*] The algorithm of service node selection for hosting Microsoft SQL Server databases was improved.
[*] Localization was updated for the following languages: German, Spanish, French, Japanese, Italian, Russian, Chinese simplified, and Chinese traditional.
[*] The calculation of hosted domains for licensing purposes was improved: now only physically hosted sites are counted.
[-] In some cases, the screens of Hosting Panel were not shown in full in Internet Explorer. (PPA-159)
[-] Dr.Web license keys could not be renewed automatically. (PPA-474)
[-] Users could not back up their subscriptions. Scheduled backups also did not work. (PPA-753)
[-] The daily maintenance task stalled during the calculation of disk space usage statistics. (PPA-805)
[-] Migration from Plesk 8 to PPA failed with the error “Error: Table ‘psa.horde.turba_objects’ doesn’t exist”. (PPA-822)
[-] Changing resource limits on a subscription could cause undesirable changes to website hosting settings. (PPA-13)
[-] FTP users could not be restored from backups created on IIS service nodes. (PPA-36)
[-] Users could not see log files for add-on domains in the Hosting Panel. (PPA-501)
[-] Administrators could not manage Microsoft SQL Server databases through Infrastructure > Database Servers > DB Webadmin. Wrong database administration tool was opened.(PPA-594)
[-] Domain forwarding configured by customers on webspaces could be reset to web hosting service after administrators or resellers changed the resource limits in the corresponding service template. (PPA-636)
[-] After upgrading from PPA 11.1 to 11.5, custom ProFTPD configurations were discarded and the operation of FTP server was disrupted. (PPA-646)
[-] Terminated license keys for Dr.Web could not be unassigned from service nodes. (PPA-724)
[-] Enabling of Apache service on PPA backup nodes could disrupt the operation of ProFTPD. (PPA-795)
[-] Webspace provisioning failed on Windows nodes with the error “SIDClient error: Unable to release input thread stack”. (PPA-853)
[-] Migration from H-Sphere could fail if the migration tool was run with the “set-dns-forwarding” option. (PPA-790)
[-] Migration from H-Sphere could fail if the SSH key access was used and the H-Sphere node was missing from the list of known hosts. (PPA-777)
[-] Users could not migrate from Plesk for Windows to PPA 11.5 if the destination service node in PPA was running Windows 2012 R2 with German locale. (PPA-751)
[-] Users could not migrate to PPA 11.5 if PPA used an external Microsoft SQL Server (which was added through Infrastructure > Database Servers). (PPA-771)
[-] Users could not transfer the contents of databases from H-Sphere to PPA if the administrator’s password for the destination MySQL server contained a bracket symbol ({). (PPA-774)
[-] Users could not upgrade the migration tool by using the command installer.sh –upgrade. (PPA-749)
[-] During migration from H-Sphere, user names were incorrectly transferred to PPA. (PPA-814)
[-] The migration tool showed error messages while migrating suspended subscriptions in multiple-webspace mode (“transfer-domains-to-subscription: same” in config.ini). (PPA-779)
[-] Migration from Expand installations with centralized mail could produce warning messages about duplicate domain administrator roles. (PPA-848)
Thousands of websites still hosted on Windows XP
Apr08
on April 8, 2014
at 9:48 am
Posted In: Uncategorized
Thousands of websites are still hosted on Windows XP computers, despite the operating system reaching the end of its extended support period today.
(Apr 5) Security Report Summary