Forum

Ron-e · 07-17-2015, 08:19 PM

Markdark has replied on the tag via PM that he could not see the video at where he is living (Kazakhstan).
So i downloaded the video and uploaded it to my dropbox so hopefully he could see it.

ahsan · 07-18-2015, 09:00 PM

I'm not sure about the windows version. But if somehow attacker exploit this bug, YOU KNOW THE DESTRUCTION.
If anyone has the latest version of Sentora on their Windows Server, Kindly share the server with me if you are comfortable with it. I'd like a quick penetration testing on it.

apinto · 07-18-2015, 09:06 PM

ahsan not sure about windows, but on Ubuntu 14 and CentOS 7 this exploit is NOT POSSIBLE unless you change the default Sentora configuration and install Perl (that was said multiple times it is not secure neither supportedd by sentora at this moment).

The FTP Account Exploit was already fixed (less than 24h after the exploit report).

ahsan · 07-18-2015, 09:11 PM

apinto I didn't change it on my centOS 6.5. Sentora for centOS 6 don't have an option to enable/disable cgi. So every Sentora Server with CentOS 6 or low is vulnerable to this.

Ron-e · 07-18-2015, 09:27 PM

(07-18-2015, 09:11 PM)ahsan Wrote: Sentora for centOS 6 don't have an option to enable/disable cgi.

Then i think it are very old installs because CGI is disabled thru the installer.
And for old installs there is a patch published.

ahsan · 07-19-2015, 05:35 AM

ahan. That's okay then.

Possibly Related Threads…
Thread	Author	Replies	Views	Last Post
Update redirect to Sentora login to an error page if a sub domain does not exist	TGates	0	1 ,905	01-28-2024, 06:20 AM Last Post: TGates
Need Sentora HELP ?	Alemiz	4	11 ,516	10-26-2018, 04:09 PM Last Post: republicus
Sentora Feedback and Ideas	Xversion	10	29 ,167	10-28-2017, 06:49 AM Last Post: TGates