CCBill's whereami.cgi vunerable to remote exploit

[webair]

malicious attackers can run arbitrary commands on your servers if you are using ccbill.

A vulnerability has been reported in CCBill whereami.cgi, which can be exploited by malicious people to compromise a vulnerable system. It is possible to supply system commands to the "g" parameter, which allows execution of arbitrary commands with the privileges of the web service.

you can safely delete whereami.cgi without effecting the way the site or ccbill's software works

webair techs have already disabled it on all managed servers and virtual servers, and we recommend anyone else do the same

more info
http://www.secunia.co.uk/advisories/9191/
http://www.securitytracker.com/alert...l/1007100.html

and you can call ccbill to confirm i guess

[AcidMax]

DOH

[bigdog]

nice to see webair has done that for their clients

[Warden]

Once again, always looking out for your customers. You guys are the best! I love you WebAir!

[ytcracker]

hack teh g1bson

[BradShaw]

I am sure they are on top of it and you can expect an update soon. Dam hackers.

[gothweb]

I'd like to hear about this from someone at CCBill.

[Naughty]

1. This file is not even necessary to have ccbill working properly, it is just for installing purposes only if I am not mistaken;
2. CC Bill changed the scripts for your account with md5 encoding, so this is history altogether


[edit: point 1.) was already in webairs post]

[Naughty]

Note: You do have to change/have it changed to the new scripts though, but it is very easy.

[SpaceAce]

Thanks for the heads-up.

SpaceAce

[SpaceAce]

Originally posted by BradShaw
I am sure they are on top of it and you can expect an update soon. Dam hackers.

Without the "damn hacker" who found this and reported it your server might be endlessly open to anyone who wanted to play around. You should send them a basket of flowers and learn to distinguish between a hacker and a cracker.

SpaceAce