Ike.ninja

Information

A CVE-2014-3566 vulnerability in SSLv3 protocol was identified by the Google security team. There is an additional whitepaper available from OpenSSL that also describes this vulnerability.

You can check if your website is vulnerable with curl:

{!{code}!}czo0MTpcImN1cmwgLXYzIC1YIEhFQUQgaHR0cHM6Ly93d3cuZXhhbXBsZS5jb20KXCI7e1smKiZdfQ=={!{/code}!}

If you are NOT vulnerable, your output should look something like this:

{!{code}!}czoyOTpcImN1cmw6ICgzNSkgU1NMIGNvbm5lY3QgZXJyb3IKXCI7e1smKiZdfQ=={!{/code}!}

If you ARE vulnerable, you will see normal connection outputs, potentially including the line:

{!{code}!}czoyOTpcIlNTTCAzLjAgY29ubmVjdGlvbiB1c2luZyAuLi4KXCI7e1smKiZdfQ=={!{/code}!}

Resolution

Although the possibility to exploit this vulnerability is quite low, the simplest way is to disable SSL 3.0 – this obsoleted protocol version is being used for compatibility needs and is not required for Parallels products.

For specific Parallels products, here is the list of articles which you may refer to:

• Parallels Plesk

• Parallels Operations Automation

• Parallels Business Automation – Enterprise

• Parallels Business Automation – Standard

• Parallels Plesk Automation

• Parallels Virtual Automation

• Parallels H-Sphere

Case 93317 Summary Limited SQL injection vulnerability in LeechProtect. Security Rating cPanel has assigned a Security Level of Minor to this vulnerability. Description The LeechProtect subsystem built into cPanel & WHM systems allows a website owner to disable HTTP logins for accounts that log in from too many distinct IP …

(Jul 6) The system could be made to crash or run programs as an administrator.

(Jun 4) chkrootkit could be made to run programs as an administrator.

(May 21) libgadu could be made to crash or run programs if it received speciallycrafted network traffic.

(May 5) The system could be made to crash or run programs as an administrator.

(Apr 30) elfutils could be made to crash or run programs if it processed a speciallycrafted file.

The following issue was resolved:

​[-] Potential minor security vulnerability was eliminated. Refer to the following KB articles for more information: http://kb.parallels.com/121310 (PPPM-1609)

(Apr 28) A malicious source package could write files outside the unpack directory.

The Netcraft Extension: Heartbleed and phishing protection rolled into one The Heartbleed bug affected around 17% of all trusted SSL web servers when it was announced a week ago.
The critical vulnerability in the OpenSSL cryptographic library has the potential to allow attackers to retrieve private keys and ultimately decrypt a server’s encrypted traffic or even impersonate […]

Multiple Parallels products are potentially affected by the ‘Heartbleed Bug’ because they are based or installed on operating systems impacted by the OpenSSL CVE-2014-0160 vulnerabilities.

The OpenSSL group has published a solution at http://heartbleed.com/.

Additionally, please review and take action outlined in these Knowledgebase articles:

• For Parallels Automation: http://kb.parallels.com/en/120984


• For Parallels Business Automation Standard: http://kb.parallels.com/en/120986


• For Parallels Plesk Panel: http://kb.parallels.com/en/120990


• For Virtualization products: http://kb.parallels.com/en/120989

================================================================

Yesterday a new vulnerability was announced in OpenSSL 1.0.1 that allows an attacker to reveal up to 64kb of memory to a connected server. Parallels is working to assess any product specific issues as a result of this OpenSSL vulnerability. We encourage everyone running a server that uses OpenSSL to upgrade to version 1.0.1g to be protected. For previous versions of OpenSSL, re-compiling with the OPENSSL_NO_HEARTBEATS flag enabled will protect against this vulnerability. We will provide any product-specific updates as they become available.

(Apr 7) File could be made to crash if it processed a specially crafted file.

(Mar 12) A security issue was fixed in libssh.

cPanel TSR 2014-0002 Full Disclosure Case 89985 Summary Disclosure of cpanel-horde’s MySQL password due to world-readable backups. Security Rating cPanel has assigned a Security Level of Important to this vulnerability. Description During the upgrade to Horde 5 on 11.42 systems, a backup tarball of the existing Horde configuration files is …

(Feb 2) Christian Mainka and Vladislav Mladenov reported a vulnerability in the OpenID module of Drupal, a fully-featured content management framework. A malicious user could exploit this flaw to log in as other users on the site, including administrators, and hijack their accounts. [More…]