Tampilkan postingan dengan label Security Advisory. Tampilkan semua postingan
SuPHP has various security enhancements over DSO
PHP such as running processes as the user rather than nobody as well as
only allowing 755 folder and 644 file permissions, the (default) option
(on cpanel) to allow individual php.ini files is a security concern.
There are several methods that can be used to disallow users to have their own php.ini files under suPHP. The path you take will depend on whether you want to allow users to have their own in some circumstances or to restrict all accounts on the server to the global php.ini file at /usr/local/lib/php.ini location.
Uncomment these lines:
There are several methods that can be used to disallow users to have their own php.ini files under suPHP. The path you take will depend on whether you want to allow users to have their own in some circumstances or to restrict all accounts on the server to the global php.ini file at /usr/local/lib/php.ini location.
Force all accounts to use the global php.ini file
To force all users to use the global php.ini file, you would edit the /opt/suphp/etc/suphp.conf file:Uncomment these lines:
[phprc_paths] ;Uncommenting these will force all requests to that handler to use the php.ini ;in the specified directory regardless of suPHP_ConfigPath settings. ;application/x-httpd-php=/usr/local/lib/ ;application/x-httpd-php4=/usr/local/php4/lib/ ;application/x-httpd-php5=/usr/local/lib/To these:
[phprc_paths] ;Uncommenting these will force all requests to that handler to use the php.ini ;in the specified directory regardless of suPHP_ConfigPath settings. application/x-httpd-php=/usr/local/lib/ application/x-httpd-php4=/usr/local/php4/lib/ application/x-httpd-php5=/usr/local/lib/Save the file, then restart Apache for good measure:
/scripts/restartsrv_httpdNow, if any account tries to put suPHP_ConfigPath into their .htaccess file, that account will return an Internal Server Error until they remove the .htaccess line. No account will be able to use another php.ini file with this as the default unless you allow the account in the php.ini file itself.
Trackback from your site.
Rating: 4.5
Reviewer: Unknown
ItemReviewed: Force Users to Use a Global PHP.ini (SuPHP on cPanel)
BSRT-2013-003 advisory released for Vulnerabilities in BlackBerry Enterprise Server components that process images could allow remote code execution. In order to address the issues, RIM has released BlackBerry Enterprise Server 5.0.4 MR2, according to Blackberry.
According to the advisory published by the company, the security holes affect the components that process TIFF images for rendering on BlackBerry smartphones.
In some cases, the security holes could also be leveraged to allow the attacker to extend access to other parts of the network.
In order to exploit the vulnerabilities that affect the Mobile Data System�s Connection Service component, the attacker would have to create a malicious webpage and convince the victim to access it.
The flaws that affect the BlackBerry Messaging Agent or the BlackBerry Collaboration Service components are more dangerous because there�s no user interaction required for the attack to be successful. The attacker must simply attach a specially-crafted TIFF image to an email or an instant message and send it to a BlackBerry smartphone.
�The user does not need to click a link or an image, or view the email message or instant message for the attack to succeed in this scenario,� the company explained.
RIM is not aware of any attacks that have leveraged these vulnerabilities, but taking into account the fact that they are considered to be of high severity, the company advises customers to update to the latest version to ensure they�re fully protected.
In addition to BlackBerry Enterprise Server 5.0.4 MR2, which can be applied to all supported versions of the product, RIM has also released an interim security update.
Rating: 4.5
Reviewer: Unknown
ItemReviewed: RIM Fixes Remote Code Execution Flaws in BlackBerry
