SB2019080113 - Multiple vulnerabilities in cPanel, cPanel

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Improper access control (CVE-ID: CVE-2016-10820)

The vulnerability allows a remote authenticated user to execute arbitrary code.

cPanel before 55.9999.141 allows daemons to access their controlling TTYs (SEC-31).

2) Credentials management (CVE-ID: CVE-2016-10821)

The vulnerability allows a remote authenticated user to gain access to sensitive information.

In cPanel before 55.9999.141, Scripts/addpop reveals a command-line password in a process list (SEC-75).

3) Improper Authentication (CVE-ID: CVE-2016-10826)

The vulnerability allows a remote authenticated user to execute arbitrary code.

cPanel before 55.9999.141 allows attackers to bypass Two Factor Authentication via DNS clustering requests (SEC-93).

Remediation

Install update from vendor's website.

References

• https://documentation.cpanel.net/display/CL/56+Change+Log
• https://forums.cpanel.net/threads/cpanel-tsr-2016-0002-full-disclosure.534481/
• https://news.cpanel.com/cpanel-tsr-2016-0002-full-disclosure/