Bugtraq: Re: Re: Re: VHCS <= 2.4.7.1 (vhcs2_daemon) Remote Root Exploit

[sad_wabi_user () nowhere com]

You cannot fix it without re-designing the VHCS security model.  The exploit is a simple example of the many many 
attack vectors that exist in the flawed design.  If you fix this particular exploit it would be simple to create 
additional ones.

The properly fix the security model of vhcs the following must be done:
The vhcs php files must not be owned by www, and they must run as a privileged user(suexec).

Also the .htacess management portion of vhcs is buggy and need to disabled or fixed.  Look at how it handles creating 
files and modifying files.. It opens then and creates them as root. Leaving it open for a symlink attack.

It gives me regret that after I give this to Wabisabilabi it appears public after 1 month.. Before wabisabilabi even 
posts it for sale..