Php 5.2.8

[jamescrown]

Hello,

There has been a recent vulnerability in PHP 5.2.6. Since Plesk 8.6 is set to use 5.2.6, all Plesk 8.6 installs fail PCI compliance.

Can you please upgrade Plesk 8.6 to use PHP 5.2.8 for %plesk_bin% and %plesk_dir%\additional\pleskphp5 ?

Due to the major changes with interface and backups (I have still yet to convert 8.6 PSA backup to 9.0 XML backup successfully) not all customers will want to upgrade to Plesk 9.0 to fix this vulnerability.

Thanks for your consideration.

 

[sergius]

Hello,

There has been a recent vulnerability in PHP 5.2.6. Since Plesk 8.6 is set to use 5.2.6, all Plesk 8.6 installs fail PCI compliance.

Can you please upgrade Plesk 8.6 to use PHP 5.2.8 for %plesk_bin% and %plesk_dir%\additional\pleskphp5 ?

Due to the major changes with interface and backups (I have still yet to convert 8.6 PSA backup to 9.0 XML backup successfully) not all customers will want to upgrade to Plesk 9.0 to fix this vulnerability.

Thanks for your consideration.

Hello James,

Thank you for the report.

For own virtual host (port 8443) Parallels Plesk Panel uses custom built PHP engine that is patched properly but shows old version.
You may hide appropriate header through %plesk_dir%\admin\php.ini. You should switch off parameter expose_php = Off.

Learn more how to update users PHP you may here

http://download1.swsoft.com/Plesk/P...6-win-advanced-administration-guide/51692.htm
http://download1.swsoft.com/Plesk/P...6-win-advanced-administration-guide/51562.htm
http://download1.swsoft.com/Plesk/P...6-win-advanced-administration-guide/51563.htm

 

[jamescrown]

Hello,

I am aware of how to upgrade PHP in %plesk_dir%\additional, however my concern is with %plesk_bin% specifically. Can you please provide your patch documentation and what vulnerabilities it covers? Thank you.

 

[jamescrown]

sergius cannot list the patches they make because their version is not patched.

 

[sergius]

sergius cannot list the patches they make because their version is not patched.

James,

It would be not securely to discuss possible product vulnerabilities at the public forum.

If you know about any actual Parallels Plesk Panel itself vulnerability then please inform me through private message and we will fix the issue as soon as possible.

 

[jamescrown]

I've simply informed you of bugs in the 3rd party components that plesk installs.

php.net advised the use of 5.2.8 as of Dec 8th 2008 due to bugs in earlier versions including 5.2.6.

Your plesk 8.6 build is from July 22 2008 and contains php 5.2.6.
Your plesk 9 build is from Dec 8th 2008 and contains a php 5.2.6.

 

[drkramer]

Plesk Software Causes ALL Sites Processing Credit Cards Failure

We use Plesk 8.6. This version installs PHP 5.2.6. Security scans by third party companies report this as a violation of the PCI agreement that governs transaction processing with credit card networks. They state the only way to comply is to use PHP 5.2.8 or above.

There is no update by Parallels available to make Plesk 8.6 compliant with PCI testing, and anyone using Plesk in this configuration is in jeopardy, unless there is an upgrade method to replace PHP to the proper version.

I think this is a serious issue, if Plesk expects customers who sell things using a credit card to use their software.

 

[jamescrown]

Parallels expects you to do the following to fix the PCI compliance issue:

1.) update the version in %plesk_dir%\additional\pleskphp5 to 5.2.8 yourself. You can just extract the php zip to this directory then update the components section of plesk.

2.) Hide the PHP version that plesk build uses by setting "expose_php = off" in %plesk_dir%\admin\php.ini

They do not see any reason to update the PHP build used at this time even though PHP.net's changelog shows numerous bugs and security fixes between 5.2.6 and 5.2.8 http://www.php.net/ChangeLog-5.php

 

[drkramer]

Thanks, James. I've followed your direction. It's alarming Plesk/Parallels sees no since of urgency protecting their client base. It took me a couple weeks to get here. Now I am more afraid of what else I don't know. I guess I expected more from such a product.

 

[jamescrown]

Its not unreasonable to expect them to keep their third party components up to date. Its just not Parallel's M.O. (look at the versions of your other components).

 

[spsgorgan]

dear sergius
please patch plesk 8.6.4 and relese it