Severity: High, Arbitrary Execution, Local Privilege Escalation

Background:
cPanel is a common web hosting management system written by cpanel.net installed on UNIX Operation Sy
stems to help manage web, email,
 ftp, databases, and other administrative tasks.

Problem Description:
The options used by cPanel software to compile Apache 1.3.29 and PHP using the mod_phpsuexec option a
re flawed and allow any local
 user to execute arbitrary code as any other user owning a web accessible php file.

Impact:
Fortunately, mod_phpsuexec is not enabled by default so the majority of systems using cPanel should n
ot be vulnerable.  But for those
 machines that are vulnerable, all users on the machine are in danger.  Any local user can destroy fi
les, deface web sites, or aquire
 full access to all databases used by anyone on the machine that owns a file ending in .php.

Proof of Concept:
This tester php script http://64.240.171.106/cpanel.php can be used to test your configuration to see
 if it is vulnerable.  See http://www.a-squad.com/audit/
 for more details.  If left unmodified, this script will do no harm.  It will just tell you if your s
ystem is safe or how to secure
 it if it is vulnerable.

How it works is by ensuring that /usr/bin/php will execute SCRIPT_FILENAME instead of the PATH_INFO i
f both environment settings exist.
  If it doesn't then the system is vulnerable because PATH_INFO can easily be spoofed on the browser.

Any user can change another user's password by temporarily tweaking the target user's .contactemail f
ile just long enough to reset
 this user's password using the built-in cpanel reset method.  To prevent this, disable the ability t
o reset passwords in the WHM.

Any user can obtain root access on the machine by manipulating one of the admin accounts' .bashrc fil
e to alias "su" to "fakesu" or
 any trojan that logs keystrokes and obtain the root password next time this admin user logs in and t
ries to "su" to root.  It's easy
 to find out admin users with "su" privileges by running "grep wheel /etc/group" 
or by running "last" to see which of these users
 logged in recently.  Due to the severity of this vulnerability, the "fakesu" trojan code w
ill not be provided, though it has been
 tested and is known to work.  To prevent this, don't let anyone that can create a .php script be in 
the "wheel" group.

Solution:
Upgrade to Apache 1.3.31 or higher.  Only systems running Apache 1.3.29 or older can be vulnerable.  
I already notified the cPanel
 authors of this vulnerability and it has been repaired.  Only Apache configurations compiled before 
Apr 15, 2004 are vulnerable.

Let me know if you need any more details.

--Rob Brown
A-Squad.Com