Mambo security flaw!

[Panther]

A security flaw was discovered in Mambo 4.5.2 and was publicized on February 20th. This is the current version that is part of the Plesk Application Pack. This vulnerability is actively being exploited! I've contacted SWsoft, but they are apparently unwilling to release an update. I highly suggest either upgrading Mambo manually or disabling it from your site.

 

[mlovick]

Yes,

I have found this to be a MAJOR disaster!

SW-SOFT - PLEASE release a patch!

This is real:

Using mambo 4.5.2 a remote attacker was able to cause APACHE to completely shutdown and then start their own TCP connection on port 80.

I have had to disable Mambo and disallow it's use through plesk.

This has caused embarassment with my clients.

V. Unhappy!

 

[mlovick]

I just heard back from SW-SOFT support. They now have a patch available.

 

[Panther]

Originally posted by mlovick
I just heard back from SW-SOFT support. They now have a patch available.

Yet the last email they sent me was a link to a page describing how to build my own package so I can create an updated package myself. Thanks for the post though.

That's after they wanted to charge me an hourly fee to fix the problem to begin with.

 

[mlovick]

What was that link please (for creating the new package).

 

[Panther]

Originally posted by mlovick
What was that link please (for creating the new package).

http://download1.swsoft.com/Plesk/Plesk7/Doc/pdf/p7-howto_apps_vault-linux.pdf

Do you have the link available for the Mambo patch?

 

[mlovick]

No link - it was sent by email in a zip file. I am not sure why they dont publish the patch, but am grateful for it anyway. If you email support again, I am sure they will send it to you.

 

[Panther]

Originally posted by mlovick
No link - it was sent by email in a zip file. I am not sure why they dont publish the patch, but am grateful for it anyway. If you email support again, I am sure they will send it to you.

<mutters under breath>
Them, not you. Thanks for the info.

 

[rembrandt]

Before everyone thinks ther're 'save' if they´ve installed a patched version of Mambo in the Application Vault: this patch doesn´t effect already installed Mambo distributions, they still have to be patched manually by the endusers.

Regards.

 

[mlovick]

Indeed - my instructions were to patch each installation of Mambo manually.

Aparently they are not going to release a fix! The problem will be sorted out in Plesk v8

hmmm...

Does anyone use the 4PSA version of Mambo? Is that kept up to date more regularly?