Plesk zero-day may be behind thousands of hacked sites

Powered by SC Magazine
 

Company works on fix.

A hacker appears to be hawking a zero-day exploit in content management system Plesk that could explain why thousands of web sites have been recently hacked.

The exploit reported by security blogger Brian Krebs was sold on underground forum Darkode by a respected hacker.

Plesk panel
 

Malware researcher Jerome Segura described the exploit as "probably one of this year’s biggest threat[s]" and noted it may target the system's File Manager.

A recent patch by Parallels failed to fix the flaw.

"...webservers are getting re-infected every day," Sequra said in a post.

 The flaw may be behind the compromise of thousands of web sites. As reported by SC, some 50,000 sites have been infected as part of a persistent malware campaign, with 5000 infected yesterday alone.

Those attacks targeted Plesk and a suite of vulnerable WordPress plugins including TimThumb, uploadify and PHPmyadmin.

Plesk promised to work on a fix after users complained their sites were still infected with malware despite having applied Parallels' latest update.

"We are currently investigating this new reported vulnerability on Plesk 10.4 and earlier. At this time the claims are unsubstantiated. We have not received any claims to confirm this vulnerability."

It recommended users upgrade to Plesk version 11.

He offered a work-around for versions 9.0 and 9.5 that while successful, had caused a fatal exception error in Plesk's File Manager.

# Check Plesk version cat /usr/local/psa/version # Install micro updates /usr/local/psa/admin/sbin/autoinstaller # Patch mkdir plesk_remote_vulnerability_fix_deployer cd plesk_remote_vulnerability_fix_deployer wget http://kb.parallels.com/Attachments/18827/Attachments/plesk_remote_vulnerability_fix_deployer.tar.gz tar -xzf plesk_remote_vulnerability_fix_deployer.tar.gz /usr/local/psa/admin/bin/php plesk_remote_vulnerability_fix_deployer.php # Rename file manager (could be a temporary fix) cd /usr/local/psa/admin/htdocs/filemanager/ mv filemanager.php filemanager.php.bak or cd /usr/local/psa/admin/bin/ mv filemng filemng.bak # remove sessions records from psa db

mysql> delete from sessions;

# Change all Plesk passwords

 

 XXX 

end

 

Copyright © SC Magazine, Australia


Plesk zero-day may be behind thousands of hacked sites
 
 
 
Top Stories
Photos: iTnews Benchmark Awards countdown begins
Just a few days left until entries close for 2014.
 
Australian Govt to rethink cyber security strategy
Six-year old policy to be refreshed.
 
The failure of the antivirus industry
[Blog post] Insights from AVAR 2014.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  38%
 
Your insurance company
  4%
 
A technology company (Google, Facebook et al)
  8%
 
Your telco, ISP or utility
  8%
 
A retailer (Coles, Woolworths et al)
  2%
 
A Federal Government agency (ATO, Centrelink etc)
  20%
 
An Australian law enforcement agency (AFP, ASIO et al)
  15%
 
A State Government agency (Health dept, etc)
  5%
TOTAL VOTES: 1051

Vote