bugtraq - Re: VHCS <= 2.4.7.1 (vhcs2_daemon) Remote Root Exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID:  <loom.20080312T014603-730@post.gmane.org>
Date: Wed, 12 Mar 2008 01:47:29 +0000 (UTC)
From: Maximiliano Müller <mmuller@...ioshispanos.com>
To: bugtraq@...urityfocus.com
Subject:  Re: VHCS <= 2.4.7.1 (vhcs2_daemon) Remote Root Exploit

Hi, 

In case you didn't have this patch. Patch  login.php as soon 
as possible (old bug).

http://vhcs.puuhis.net/index.php?option=com_content&task=view&id=14&Itemid=1

For the new bug this is a quick solution

* to modify the php.ini and to disable shell and execute functions

disable_functions = system,system_exec,passthru,shell,shell_exec,exec

* to not permit LOAD INLINE from mysql.  We can disable this feature with 
the following  line to the my.cnf in the section [mysqld]

local-infile=0