Plesk Obsidian for Linux
Situation
A security vulnerability has been discovered in Phusion Passenger's Watchdog API.
Affected product version
| Product | Affected versions | Patched versions |
|---|---|---|
| Plesk for Linux |
|
|
Impact
Local privilege escalation is possible.
Call to action
Update Plesk to the latest build: How to update Plesk Obsidian to the latest build
Patching closes the vulnerability going forward, but it does not undo anything an attacker may have already done. If Passenger was installed and reachable on your server before you patched, we recommend checking for signs of prior compromise:
-
Check
/etc/ld.so.preloadfor unexpected entries. This is the file the exploit targets directly — any unfamiliar path listed there should be treated as a strong indicator of compromise. -
Review root's crontab and system-wide cron directories (
/var/spool/cron/,/etc/cron.d/,/etc/cron.daily/, etc.) for jobs you don't recognize. -
Check for new SSH keys in
/root/.ssh/authorized_keysand in theauthorized_keysfiles of other system accounts. - Check for new or unexpected Plesk administrator accounts, and any changes to existing admin account permissions.
-
Look for unexpected SUID/SGID binaries on the filesystem (for example,
find / -perm -4000 -o -perm -2000and compare against a known-good baseline).
How to verify that a server is patched
Follow the steps from the How to find version of Plesk installed on server?
Comments
With all theses CVE's as of late; isn't it easier to simply (and only) use: plesk installer install-panel-updates
Or do you really need to run plesk installer? Or is there a better method which answers yes/or continues the installer incase of warnings, altered templates, dead mariadb repos and so on?
Please provide details. Thank you.
Please sign in to leave a comment.