Author Topic: Security Advisory – HostBill versions 4.x  (Read 5332 times)

0 Members and 1 Guest are viewing this topic.

Offline Lawrence

  • 573
  • 22
  • Community Manager
  • Active Participant
  • *****
    • Lawrence Wright
Security Advisory – HostBill versions 4.x
« on: June 11, 2013, 04:05:46 AM »
There's been a security advisory for HostBill versions 4.x. This applies for anyone under the 4.x branch.

If you have the auto patcher, use it. If you'd rather update manually, continue reading.

You can download the security patch here.
- https://hostbillapp.com/clientarea/patches/hostbill_patch4.6.4_4347.zip

When you've downloaded the security patch, extract the contents into the main HostBill directory.
Skype: sociallarry | AIM: larry.aim@aim.com | Forum Rules & Information

These forums are hosted by me with no intentions to ever monetize them. These forums are here solely for the benfit of the HostBill community.

Offline CBlade

  • 50
  • 1
  • Active Participant
  • ***
  • One man company
Re: Security Advisory – HostBill versions 4.x
« Reply #1 on: June 11, 2013, 07:00:03 AM »
What this one about?

Offline UCG_Keith

  • 57
  • 9
  • Active Participant
  • ***
    • Secure - Compliant Cloud Host & Data Center
Re: Security Advisory – HostBill versions 4.x
« Reply #2 on: June 11, 2013, 09:10:12 AM »
Hi Lawrence,

Curious about the security patch; where is the CVE about the issue?  Was it published by HostBill? 

Offline Lawrence

  • 573
  • 22
  • Community Manager
  • Active Participant
  • *****
    • Lawrence Wright
Re: Security Advisory – HostBill versions 4.x
« Reply #3 on: June 11, 2013, 01:07:04 PM »
This was posted here,
- http://extras.hostbillapp.com/
Skype: sociallarry | AIM: larry.aim@aim.com | Forum Rules & Information

These forums are hosted by me with no intentions to ever monetize them. These forums are here solely for the benfit of the HostBill community.

Offline nldaniel

  • 6
  • 0
  • New Member
  • *
Re: Security Advisory – HostBill versions 4.x
« Reply #4 on: June 19, 2013, 12:55:38 AM »
Looks like we might be in for some rough waters;

http://www.webhostingtalk.com/showthread.php?t=1277173
http://vpsboard.com/topic/786-hostbill-source-code-released-and-0-day-exploits-found/?p=11769

I'm still downloading to see what actually could be vulnerable; regardless we've still taken measures and disabled public hostbill in light of current SolusVM hacks.

Edit: Looks like just the front index.php got decoded; nothing backing up the "exploits found" claim
« Last Edit: June 19, 2013, 02:13:30 AM by nldaniel »

Offline Patrick

  • 620
  • 17
  • Active Participant
  • *****
  • HBF Volunteer
Re: Security Advisory – HostBill versions 4.x
« Reply #5 on: June 19, 2013, 01:43:50 AM »
Looks like we might be in for some rough waters;

http://www.webhostingtalk.com/showthread.php?t=1277173
http://vpsboard.com/topic/786-hostbill-source-code-released-and-0-day-exploits-found/?p=11769

I'm still downloading to see what actually could be vulnerable; regardless we've still taken measures and disabled public hostbill in light of current SolusVM hacks.


Looking through the "source" files and a lot of it is still encrypted.  So far almost every file i've looked at.  This almost appears to be a false claim.  I cannot take this seriously until i see more.
« Last Edit: June 19, 2013, 01:52:04 AM by Patrick »
Patrick - Forum Rules
Insanity: doing the same thing over and over again and expecting different results. - Albert Einstein

Offline cloudhopping

  • 39
  • 4
  • Active Participant
  • **
    • Skype - vinehosting
Re: Security Advisory – HostBill versions 4.x
« Reply #6 on: June 19, 2013, 03:12:02 AM »
I agree -  The real question however is -   If someone decoded 1 file -
can they do more.

It could be a teaser - just in case I am keeping my ears to the ground in a few of the communities we all know exist for this kind of stuff - just in case.


Offline TommyK

  • 57
  • 3
  • Active Participant
  • ***
Re: Security Advisory – HostBill versions 4.x
« Reply #7 on: June 19, 2013, 09:12:34 AM »
Nothing from Kris on this yet?

Offline Patrick

  • 620
  • 17
  • Active Participant
  • *****
  • HBF Volunteer
Re: Security Advisory – HostBill versions 4.x
« Reply #8 on: June 19, 2013, 10:21:45 AM »
The one file was decoded by dezender.  It is a legitimate decoder web site that charges about $5 a file.  So someone paid to decode the 1 file and create a "scare" is my opinion of it at this moment in time.  Not saying this isn't something to be taken lightly but right now there is absolutely no evidence that i can see to the contrary
Patrick - Forum Rules
Insanity: doing the same thing over and over again and expecting different results. - Albert Einstein

Offline cloudhopping

  • 39
  • 4
  • Active Participant
  • **
    • Skype - vinehosting
Re: Security Advisory – HostBill versions 4.x
« Reply #9 on: June 19, 2013, 12:05:40 PM »
with places like  Linked removed for legal reasons

it is only a matter of time before someone writes a simple script to shoot a command and decrypt each with $0 invested.

I do not place the blame for this on Kris - ioncube needs to step up the game and ensure that these tools do not work once they are made and allow recryption (is that a word)  if their crypt gets wanked...

« Last Edit: June 20, 2013, 01:23:35 AM by Lawrence »

Offline CBlade

  • 50
  • 1
  • Active Participant
  • ***
  • One man company
Re: Security Advisory – HostBill versions 4.x
« Reply #10 on: June 19, 2013, 12:16:49 PM »
Ok, they decoded it, what version? Now this mean we will see a Open Hostbill project under GPL?

Offline joel

  • 5
  • 0
  • New Member
  • *
    • Skype - joel
Re: Security Advisory – HostBill versions 4.x
« Reply #11 on: January 08, 2014, 07:50:38 PM »
Hi,

Is there any way to find the host bill installations on a cpanel server?

Offline Enterprisevpssolutions

  • 303
  • 13
  • Community Managers
  • Active Participant
  • *****
    • Skype - enterprisevpssolutions
    • Enterprise Vps Solutions
Re: Security Advisory – HostBill versions 4.x
« Reply #12 on: January 09, 2014, 02:26:17 AM »
You have to be a little more specific on the question. Are you talking about looking for the install folder? http://wiki.hostbillapp.com/index.php?title=Installation. You need to start another post if you need help.
Enterprise Vps Solutions (VPS) - Cloud Solutions, Shared hosting, VPS , and more, Fast Dedicated Servers. Great ssl prices SSL Certs, Follow us on Twitter. Sales Question? Contact us! Send us a Request Tampa , Florida Hivelocity Datacenter

Offline joel

  • 5
  • 0
  • New Member
  • *
    • Skype - joel
Re: Security Advisory – HostBill versions 4.x
« Reply #13 on: January 10, 2014, 12:10:06 PM »
Hello,

Thanks for your updates. My intention was to look for all hostbill installations under the accounts in a cPanel server and patch the new version. Need your suggestion to find out the best way to proceed.


Offline joel

  • 5
  • 0
  • New Member
  • *
    • Skype - joel
Re: Security Advisory – HostBill versions 4.x
« Reply #14 on: January 15, 2014, 02:52:09 PM »
Hi,

Any update regarding this?.