Security update for ISPConfig 3 available

Discussion in 'General' started by till, May 11, 2012.

  1. till

    till Super Moderator Staff Member ISPConfig Developer

    ISPConfig 3.0.4.5 is available for download. This release is a bugfix release for ISPConfig 3.0.4.

    This release contains a security patch for an SQL injection vulnerability:

    http://bugtracker.ispconfig.org/index.php?do=details&task_id=2221

    It is highly recommended to install the 3.0.4.5 update immediately.
    If installing the full update is not possible on your server,
    then install the patch manually:

    Code:
    cd /tmp
    wget http://www.ispconfig.org/downloads/ISPConfig-3-stable.tar.gz
    tar xvfz ISPConfig-3-stable.tar.gz
    mv -f ispconfig3_install/interface/lib/classes/listform.inc.php /usr/local/ispconfig/interface/lib/classes/
    For a detailed list of changes, please see the changelog section below.

    =====================================================
    *** New! The ISPConfig 3 manual is now available! ***

    Version 1.3 for ISPConfig >= 3.0.4 (Date: 10/25/2011)
    Author: Falko Timme <[email protected]>

    333 pages

    The manual can be downloaded from these two links:

    http://www.ispconfig.org/ispconfig-3/ispconfig-3-manual/
    http://www.howtoforge.com/download-the-ispconfig-3-manual
    =====================================================

    -----------------------------------------------------
    - Download
    -----------------------------------------------------

    The software can be downloaded here:

    http://prdownloads.sourceforge.net/ispconfig/ISPConfig-3.0.4.5.tar.gz

    ------------------------------------
    - Changelog
    ------------------------------------

    http://bugtracker.ispconfig.org/index.php?do=index&tasks=&project=3&due=67&status[]=

    --------------------------------------
    - Known Issues:
    --------------------------------------

    Please take a look at the bugtracker:

    http://bugtracker.ispconfig.org

    --------------------------------------
    - BUG Reporting
    --------------------------------------

    Please report bugs to the ISPConfig bugtracking system:

    http://bugtracker.ispconfig.org

    ----------------------------------------
    - Supported Linux Distributions
    ----------------------------------------

    - Debian Etch (4.0) - Squeeze (6.0) and Debian testing
    - Ubuntu 7.10 - 12.04
    - OpenSuSE 11 - 12.1
    - CentOS 5.2 - 6.2
    - Fedora 9 - 15

    -----------------------------------------
    - Installation
    -----------------------------------------

    The installation instructions for ISPConfig can be found here:

    http://www.ispconfig.org/ispconfig-3/documentation/

    or in the text files (named INSTALL_*.txt) which are inside the docs folder of the .tar.gz file.

    ------------------------------------------
    - Update
    ------------------------------------------

    To update existing ISPConfig 3 installations, run this command on the shell:

    ispconfig_update.sh

    Select "stable" as the update resource. The script will check if an updated version of ISPConfig 3 is available and then download the tar.gz and start the setup script.

    Detailed instructions for making a backup before you update can be found here:

    http://www.faqforge.com/linux/controlpanels/ispconfig3/how-to-update-ispconfig-3/

    If the ISPConfig version on your server does not have this script yet, follow the manual update instructions below.

    -------------------------------------------
    - Manual update instructions
    -------------------------------------------

    Code:
    cd /tmp
    wget http://www.ispconfig.org/downloads/ISPConfig-3-stable.tar.gz
    tar xvfz ISPConfig-3-stable.tar.gz
    cd ispconfig3_install/install
    php -q update.php
     
  2. ngoyette

    ngoyette Member

    thank you patching right now
     
  3. keen

    keen New Member

    Thank you for the support. My system seems to stop responding at the following:

    Code:
    ispconfig3_install/helper_scripts/debian_setup.sh
    ispconfig3_install/helper_scripts/setup_in_openvz/
    ispconfig3_
    The last line is where the update stops. Any help is appreciated!
     
  4. till

    till Super Moderator Staff Member ISPConfig Developer

    Thats most likely the shell connection and not the ispconfig updater. Press the return key to continue.
     
  5. keen

    keen New Member

    Thank you till for your help! Two issue have now presented themselves.

    1) ISPConfig is displaying the following warning:

    Code:
    Server: server1.example.com (Debian Unknown)
    ISPConfig 3.0.4.5
    State: info (0 unknown, 0 info, 1 warning, 0 critical, 0 error)
    ok:
    The state of your Hard-Disk space is ok [More...]
    Your virus protection is ok [More...]
    Your Mail queue load is ok [More...]
    Your RAID is ok [More...]
    Your Server load is ok [More...]
    All needed services are online [More...]
    The System Log is O.K. [More...]
    
    warning:
    One or more components needs an update [More...]
    When I click on "More..." for the components in need of an update, the following is displayed:

    Code:
    Reading package lists...
    Building dependency tree...
    Reading state information...
    The following packages will be upgraded:
    hdparm sudo
    2 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
    Inst sudo [1.8.3p1-1ubuntu3] (1.8.3p1-1ubuntu3.1 Ubuntu:12.04/precise-updates [i386])
    Inst hdparm [9.37-0ubuntu3] (9.37-0ubuntu3.1 Ubuntu:12.04/precise-updates [i386])
    Conf sudo (1.8.3p1-1ubuntu3.1 Ubuntu:12.04/precise-updates [i386])
    Conf hdparm (9.37-0ubuntu3.1 Ubuntu:12.04/precise-updates [i386])
    When I return to the server status page, I continue to get the same message as above. When I log into the shell as root, it doesn't inform me there is a need to update.

    2) When I try to upload a file to the server via an upload form, I receive a 500 error. Perhaps the PHP/Apache2 limits have been re-instated? After the upgrade, I left all settings "as-is" as to not cause disruption.

    Once again, than you for all the help and the prompt attention.
     
  6. till

    till Super Moderator Staff Member ISPConfig Developer

    1) Thats ok, just wait some time. The status for os updates is refresehd only a few times a day as we would might overload the repository servers of the distributions otherwise.

    2) No limits were changed by the update. At least of you havent edited any of the ispconfig apache config files manually. Take a look into the error.log of the website, you fidn the reason for the problem there.

    A likely issue might be this one, but thats not configured by ispconfig:

    http://www.faqforge.com/linux/fix-h...-exceeds-maxrequestlen-error-on-debian-linux/
     
  7. chrism12

    chrism12 New Member

    still asking me to update

    i have installed the update on 2 of my servers however 1 of them still says its running version 3.0.4.4 and is asking me to update while the other has updated sucessfully.
     
  8. till

    till Super Moderator Staff Member ISPConfig Developer

    Logout and login again. The version number is stored in the user session.
     
  9. chrism12

    chrism12 New Member

    i have tried that and deleting temp internet files but it still says 3.0.4.4
     
  10. till

    till Super Moderator Staff Member ISPConfig Developer

    Check the files /usr/local/ispconfig/server/lib/config.inc.php and /usr/local/ispconfig/interface/lib/config.inc.php. If they contain version number 3.0.4.4, then redo the update on that server. If they contain 3.0.4.5, then the server is up to date.
     
  11. chrism12

    chrism12 New Member

    it was my fault, i hadnt deleted the original zip sot it was unziping the 3.0.4.4 zip and updating that!
     
  12. Hans

    Hans Moderator Moderator

    Upgrade successfully

    Till & Falko,
    Thank you a lot for this important security release.
    I upgraded all my servers successfully with this new version of ISPConfig3.
     
  13. poisen

    poisen New Member

    is there anything I have to be careful about when updating a master and its slave system?
     
    Last edited: May 12, 2012
  14. hostedby

    hostedby New Member

    swedish lang

    Hey,

    I just made the recommended update from 3.0.4.4 to 3.0.4.5 on 2 of my servers but no I can not import the language file to any one of them. Any suggestions?

    I can not edit the language files directly in the admin area either.

    It just loads forever. I dont save cache/cookies in my web browser by default and have restarted the browser several times without any change. I also tried restarting the server, but no change, and theres plenty of free resources on them both.

    Kind regards/Michael
     
  15. falko

    falko Super Moderator Howtoforge Staff

    Update the master first and then the slave(s).
     
  16. falko

    falko Super Moderator Howtoforge Staff

    I've added this to our bugtracker. Maybe there's a syntax error in any of the Swedish language files.
     
  17. fatbear

    fatbear Member HowtoForge Supporter

    PHP system call hangs on mailman restart

    Thanks for the update.

    Please note that on my CentOS 6.2 x64 system the script hanged after restarting the mailman service. Looking at the script, I see the restart line for mailmain in update.php:

    mkdir ~/src
    wget http://www.ispconfig.org/downloads/ISPConfig-3-stable.tar.gz
    tar xzpf ISPConfig-3-stable.tar.gz
    cd ispconfig3_install/install
    vi update.php


    Because the script hangs, I have to kill the update process with a CTRL-C. This leaves some services not restarted or reloaded. The line in which the problem happens is this:

    if($conf['mailman']['init_script'] != '' && is_executable($conf['init_scripts'].'/'.$conf['mailman']['init_script'])) system($conf['init_scripts'].'/'.$conf['mailman']['init_script'].' restart');

    I note that this problem disappears if I change the above to:

    if($conf['mailman']['init_script'] != '' && is_executable($conf['init_scripts'].'/'.$conf['mailman']['init_script'])) system("nohup ".$conf['init_scripts'].'/'.$conf['mailman']['init_script'].' restart'.">/dev/null 2>&1 &");


    I did confirm that the mailman init script does, in fact, terminal normally. Just why the php system call fails, I haven't determined, but the above workaround does work.
     
  18. falko

    falko Super Moderator Howtoforge Staff

    I've added this to our bugtracker.
     
  19. falko

    falko Super Moderator Howtoforge Staff

    I've just tested this and had no problems. Can you tell me what exactly you did so that I can reproduce the problem? Is it a specific language file you cannot edit, or are all language files affected? Also, exporting and importing worked fine for me.
     
  20. matiasCU

    matiasCU Member

    Not vice versa? First slave and then the master?
    The documentation say:

    If you use the command line update to update multiple servers, it is strongly recommended to run the update on the slaves first and afterwards on the master!

    Tks
     

Share This Page