Parallels takes the security of its partners very seriously and regularly advises partners about how they can protect themselves against new threats. The exploit warned about by a Cisco researcher was in the 3rd party Horde webmail for Plesk 9.3 and earlier (products circa 2009 and earlier), not in the Plesk control panel itself. These Plesk versions are end-of-lifed now, but a patch was promptly issued in Februrary 2012 at http://kb.parallels.com/en/113374.

Parallels agrees with this Cisco researcher: “The active exploit of this year-old vulnerability serves as an important reminder that website operators and administrators must keep systems up-to-date. This is especially urgent with vulnerabilities that are remotely detectable. This means not just the operating system, but every program and add-on for those programs also needs to be kept up-to-date. A vulnerability left unpatched in any one of them can lead to total system compromise.”

We also strongly encourage our customers to subscribe to our support e-mails, subscribe to our RSS feed and add our KnowledgeBase browser plug-in.