I have plesk 10.3.1 and I received following email from the Plesk admin
Parallels, the manufacturer and distributor of the Plesk Control Panel, has identified a SQL injection security vulnerability in some older versions of the control panel. This vulnerability is considered critical in nature and Parallels advises that you take action quickly.
Parallels released a "MicroUpdate" that makes patching this vulnerability easy. Please refer to the following Parallels Knowledge Base article for the MicroUpdate file as well as instructions and a complete list of affected control panel versions: http://kb.parallels.com/en/113321
root@***:/# cat /root/.autoinstaller/microupdates.xml <?xml version="1.0" encoding="UTF-8" standalone="yes" ?> <patches> <product id="plesk" version="10.3.1" installed-at="not-a-date-time"> <patch version="17" timestamp="" installed-at="20120207T062525" /> </product> </patches>
I refered the document I got the follwoing solugion
... fixes are provided by the Micro-Updates listed below: 8.6.0 for Linux only MU#2 - http://kb.parallels.com/en/112181 9.5.4 for Linux only MU#11 - http://kb.parallels.com/en/112179 10.0.1 for Linux and Windows MU#13 - http://kb.parallels.com/en/113322 10.1.1 for Linux and Windows MU#22 - http://kb.parallels.com/en/113323 10.2.0 for Linux and Windows MU#16 - http://kb.parallels.com/en/113324 10.3.1 for Linux and Windows MU#5 - KB is absent
Does it mean I have already update to latest version and I dont need to worry about the threat?? Please help me...
Thanks in advance..