EG Secure Solutions Inc. SiteGuard Server Edition for Apache httpd, EG Secure Solutions Inc. SiteGuard Server Edition for Nginx, EG Secure Solutions Inc. SiteGuard Server Edition for IIS, EG Secure Solutions Inc. SiteGuard Server Edition for Apache httpd on FreeBSD, EG Secure Solutions Inc. SiteGuard Server Edition for Nginx on FreeBSD

What this is

SiteGuard Server Edition has a flaw that can let an attacker make the system running it execute their own commands with the highest privileges.

How it can harm you

An attacker with local access and limited permissions could run their own program with full administrative powers on the affected system. They could read private files, change or delete records, or stop programs. No action by another user is needed. The flaw does not explain how an attacker would first obtain local access.

How urgent it is

This vulnerability is already being used in attacks. Install the corrected release to prevent someone with limited local access from gaining full administrative powers through this flaw.

Who is affected

SiteGuard Server Edition for Apache httpd and SiteGuard Server Edition for Nginx are affected from Ver2.20 up to, but excluding, Ver8.00 Update 5. SiteGuard Server Edition for IIS is affected from Ver2.20 up to, but excluding, Ver3.10, and again from Ver4.00 Update 5 up to, but excluding, Ver8.00 Update 5. SiteGuard Server Edition for Apache httpd on FreeBSD and SiteGuard Server Edition for Nginx on FreeBSD are affected from Ver2.20 up to, but excluding, Ver7.00 Update 6.

What to do

Update SiteGuard Server Edition for Apache httpd and SiteGuard Server Edition for Nginx to Ver8.00 Update 5. For SiteGuard Server Edition for IIS, update the affected branch before Ver3.10 to Ver3.10, and the affected branch starting at Ver4.00 Update 5 to Ver8.00 Update 5. Update SiteGuard Server Edition for Apache httpd on FreeBSD and SiteGuard Server Edition for Nginx on FreeBSD to Ver7.00 Update 6. Consult the vendor advisory for the update procedure.

How to check your server

Find the exact installed product name and version in its version information or installation records. Compare both with the affected ranges and corrected releases in the vendor advisory.

Check your server for free →