Ike.ninja

The following issues were resolved:

[-] (Customer & Business Manager) The upgrade from 11.0.9 to 11.5.30 failed with the error “1054 Unknown column ‘allow_multiply'”. (PPPM-1220)
[-] (Customer & Business Manager) Incorrect calculation of prices took place if a comma (“,”) was used instead of a dot (“.”) in the Prices & Taxation field in service plan settings. (PPPM-881)
[-] Unnecessary backslashes were displayed in the French locale.
[-] (Linux) The daily maintenance task failed if mailbox and domain names were in the mixed case. (PPPM-817)
[-] (Windows) The system user of a subscription did not have any permissions to the main domain’s /httpdocs directory after the user was renamed.
[-] After applying the “Domain admin owned by admin” -> “Customer” transition scheme to the new business model after upgrading Panel from old versions like 9.x, the subscription’s auxiliary users were not transferred to the new owner. (PPPM-1129)
[-] (Windows) The Collect Info tool did not collect logs from the php_error.log and panel.log files when the tool was run in the middle mode. (http://kb.parallels.com/116674)

(Dec 20) Fraudulent security certificates could allow sensitive information tobe exposed when accessing the Internet.

Case 84681

Summary

Arbitrary file read for ACL limited reseller accounts via XML-API.

Security Rating

cPanel has assigned a Security Level of Important to this vulnerability.

Description

The WHM XML and JSON APIs allowed arbitrary files to be read through the “getpkginfo” API call. By sending a crafted input to this call, resellers with the “viewglobalpackages” ACL could read the contents of files accessible only to root.

Credits

This issue was discovered by the cPanel Security Team.

Solution

This issue is resolved in the following builds:

11.40.1.7 & Greater
11.40.0.31 & Greater
11.38.2.15 & Greater
11.36.2.12 & Greater

Please update your cPanel & WHM system to one of the aforementioned versions or the latest public release available. A full listing of published versions can always be found at http://httpupdate.cpanel.net/

For the PGP-signed message, see TSR-2013-0012-FullDisclosure.