HOW TO: Update OpenSSL for Plesk Control panel

[thijshoutenbos]

The version of OpenSSL used by the Plesk Control Panel (Apache) contains a vulnerability that may allow an attackers to cause a DoS attack, or even worse: possibly gain a remote shell.

This vulnerability was present in the most recently update Plesk 7.6, and was confirmed by scanning the host with the online security audit tool Hackerguardian.

To update to the latest version you need to download the latest OpenSSL from Sourceforge:
http://sourceforge.net/project/downloading.php?groupname=gnuwin32&filename=openssl-0.9.7c-bin.zip

You need to replace the files 'libssl32.dll' and 'libeay32.dll' in the folder 'C:\Program Files\SWsoft\Plesk\admin\bin' (or any other location you installed Plesk). Be sure to back up the DLLs you replace before overwriting them. After restarting your Plesk Control Panel service you now use the updated OpenSSL library and should no longer be vulnerable to this attack (this was also verified by re-scanning the server with Hackerguardian).

Perhaps this fix will be included in an official patch from SWsoft later, but for now I thought it was wise to share this little HOWTO with you.

 

[SGr33n]

After this I had a problem:

The service did not respond to the start of control request in a timely fashion. (Error code 1053) at StartService 'PLESKMISCRV'

The Plesk Miscellaneous Service didn't start.

 

[thijshoutenbos]

Hmmm... strange that the Plesk Control Panel would work fine with this update, but the Plesk Miscellaneous Service does not work...

Well, it's a good thing the replaced DLLs are backed up. You can just copy those backups back to restore the previous version and the problem is gone...

I hope SWsoft will add the latest version of OpenSSL to their automated updates soon and plug this problem.

 

[SGr33n]

Originally posted by thijshoutenbos

Well, it's a good thing the replaced DLLs are backed up. You can just copy those backups back to restore the previous version and the problem is gone...

It's what I've done
Otherwise new openSSL included also an openssl.exe, probably is the old one that generate this issue.