bugtraq - Re: Re: Re: VHCS <= 2.4.7.1 (vhcs2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 13 Mar 2008 16:41:06 -0000
From: sad_wabi_user@...here.com
To: bugtraq@...urityfocus.com
Subject: Re: Re: Re: VHCS <= 2.4.7.1 (vhcs2_daemon) Remote Root Exploit

You cannot fix it without re-designing the VHCS security model.  The exploit is a simple example of the many many attack vectors that exist in the flawed design.  If you fix this particular exploit it would be simple to create additional ones.

The properly fix the security model of vhcs the following must be done:
The vhcs php files must not be owned by www, and they must run as a privileged user(suexec).

Also the .htacess management portion of vhcs is buggy and need to disabled or fixed.  Look at how it handles creating files and modifying files.. It opens then and creates them as root. Leaving it open for a symlink attack.

It gives me regret that after I give this to Wabisabilabi it appears public after 1 month.. Before wabisabilabi even posts it for sale..