Vulnerabilities in old Plesk versions on Windows - Patch Issue

[Client ServicesT]

Hello,

I am hoping that someone can assist in answering a question regarding application of a recently released vulnerability patch.

System Details

Plesk Version: 8.6.0 For Windows
OS: Windows Server 2003 Standard x86_64
KB: http://kb.parallels.com/en/112303

Issue

Attempted to replace the files in question:

%plesk_dir%\admin\plib\api-rpc\Agent.php
%plesk_dir%\admin\plib\class.Session.php
%plesk_dir%\admin\htdocs\help.php

After backing up the original files and placing the new ones in the respective directories the Plesk service was restarted (Services > Plesk Control Panel Service > Restart). When browsing to the Plesk URL for the server the following error message is displayed:

Warning: require_once(class.Session.php) [function.require-once]: failed to open stream: No such file or directory in C:\Program Files (x86)\Parallels\Plesk\admin\auto_prepend\auth.php3 on line 153

Fatal error: require_once() [function.require]: Failed opening required 'class.Session.php' (include_path='C:\Program Files (x86)\Parallels\Plesk\admin\plib;C:\Program Files (x86)\Parallels\Plesk\admin\plib\api-rpc;C:\Program Files (x86)\Parallels\Plesk\admin\javascripts;C:\Program Files (x86)\Parallels\Plesk\admin\plib\locale;C:\Program Files (x86)\Parallels\Plesk\admin\auto_prepend;C:\Program Files (x86)\Parallels\Plesk\admin\htdocs\domains\databases\phpMyAdmin;C:\Program Files (x86)\Parallels\Plesk\admin\htdocs\domains\databases\phpPgAdmin') in C:\Program Files (x86)\Parallels\Plesk\admin\auto_prepend\auth.php3 on line 153

The files were then rolled back to the original versions and the service was restarted again (Services > Plesk Control Panel Service > Restart). The Plesk panel loads fine again.

Question

Does anyone know if a reboot of the server is required to successfully apply the patched files or is there some other issue going on here? Attempted to trace the code, but the PHP files appear to be compiled so they are not viewable by normal means.
Any suggestions or feedback would be greatly appreciated.

 

[Client ServicesT]

It was confirmed that a reboot is required to successfully apply these patches. It would have been helpful if this information was included in the KB that is specific to Windows. It is possible that a IIS or restart of some other service would have prevented a reboot of the entire system, but again, I believe it would have been good for this information to be supplied in the KB.

 

[Chris Buckley]

I have exactly the same problem after applying the patches, and I have restarted the server too to no avail.

What do I need to do next to restore access?

My server was infiltrated by the malicious code on a approximately 10 different websites so I cannot roll the files back.

Help!

Chris.

 

[Chris Buckley]

PS. We're currently unable to manage anything through the panel - could anyone from Parallels (or others) please help with this as its quite urgent now

Chris.

 

[Chris Buckley]

Any updates on this? Still struggling...

 

[worldwidedigital]

Ran same update, and it hosed my Panel

It now says "This file is part of Plesk distribution. It cannot be run outside of Plesk environment." I cannot use the Plesk Admin Panel at all now. Grreat. Nice "fix".

And Parallels is ignoring this? Several forum posts with no official replies and still no knowledge base article on this issue.

Can anyone help?