View Attach (1) Info

Add new attachment

Only authorized users are allowed to upload new attachments.

List of attachments

Kind Attachment Name Size Version Date Modified Author Change note
jpg
 minor_update.jpg 356.6 kB 1 05-Dec-2023 05:32 Ada Csaba

This page (revision-34) was last changed on 22-Apr-2024 15:52 by Ben Spink

This page was created on 05-Dec-2023 05:32 by Ben Spink

Only authorized users are allowed to rename pages.

Only authorized users are allowed to delete pages.

Difference between version and

At line 1 changed 5 lines
!!!Minimum safe CrushFTP version is 10.5.6. (Regularly updating is critical and we make that as easy as possible.)\\
Video covering the simple update process: [https://youtu.be/2pKyYxGJEwE]\\
----
!!REGARDING 10.5.6 and the recent global SSH vulnerability which also affected CrushFTP! (not CrushFTP specific, but we are affected just like most other server vendors)
Read more about it here: [https://eprint.iacr.org/2023/1711.pdf]\\
CrushFTP v11 has no known vulnerabilities.\\
At line 7 changed 41 lines
!!REGARDING THE RECENT VULNERABILITY ANNOUNCEMENT NOVEMBER 16, 2023!
If your CrushFTP is lower than 10.5.5, you are vulnerable to an exploit that was responsibly disclosed. It is not known to be in he wild, but its severe and everyone must update immediately. All versions of CrushFTP...v4/v5/v6/v7/v8/v9/v10 were affected by this. CrushFTP v11 is not affected by this as it has been patched before its first public release. One part of the vulnerability allows an attacker to gain access simply by knowing the admin username, and the other parts when used together allows an attacker who has a non privileged account to gain access to files outside their VFS which can then be in turn used to login as a more privileged user. CVE release is pending. Credit goes to the UK NCSC.\\
\\
!!REGARDING THE RECENT VULNERABILITY ANNOUNCEMENT AUGUST 10, 2023! (CVE-2023-43177)
\\
If your CrushFTP version is less then 10.5.1, you are vulnerable. No exception. Look at your version number on the dashboard, and it must be 10.5.1 or higher to be safe. For reference, v6, v7, v8,v9...those numbers are less than v10.5.1. Yes, they are vulnerable! Anything below 10.5.1 is vulnerable.\\
This vulnerability is critical because it does NOT require any authentication. It can be done anonymously and steal the session of other users and escalate to an administrator user. Its critical everyone updates ASAP! 10.5.2 changes other defaults related to loading DB drivers that are not in your classpath has also changed. This means if your DB drivers are not part of your plugins/lib folder, they will not be loaded by CrushFTP. (Statistics DB if you changed it, SQL Users if you are using that, etc.)\\
\\
__IMPORTANT: due to the security updates since CrushFTP version 10.5.2+ any JDBC driver jar file needs to be placed into the CrushFTP10/plugins/lib/ directory, or it won't load. In case of a server previously configured using an external SQL user DB, this new feature prevents access on next launch, will need to move the jar file, then edit prefs.XML, update the <db_driver> key value like\\
{{{<db_driver>./mssql-jdbc-12.4.0.jre11.jar</db_driver>}}}
\\
\\
!!Updating CrushFTP v10
!How to update CrushFTP within the same major version number:
1.) Login to the dashboard using your "crushadmin" equivalent user in the WebInterface.\\
2.) Click on the about tab.\\
3.) Click Update, Update Now.\\
4.) Wait roughly 5 minutes for the files to download, unzip, and be copied in place. CrushFTP will auto restart once done.\\
5.) Finished.\\
\\
[{Image src='minor_update.jpg' width='1080' height='..' align='left' style='..' class='..' }]\\
\\
!Installing an offline update when the server cannot reach our server over the internet directly:
1.) Download CrushFTP10.zip from our download page. ([https://www.crushftp.com/early10/CrushFTP10.zip|https://www.crushftp.com/early10/CrushFTP10.zip])\\
2.) Give it the specific name `CrushFTP10_new.zip` and place this in the CrushFTP main folder. (Same location where you have your prefs.XML file)\\
3.) See above normal instructions as Crush will use your local offline zip file.\\
!How to restore a backup in the event of some issue or regression in functionality:
(CrushFTP automatically creates a backup of its core files in the CrushFTP folder, backup folder.)\\
1.) Restore the CrushFTP.jar file.\\
2.) Restore the plugins folder.\\
3.) Restore the WebInterface folder...mainly the CrushTunnel.jar file from inside it.\\
\\
!Changelog: [https://www.crushftp.com/version10_build.html]\\
\\
!!Updating an old CrushFTP v9
You must upgrade: [CrushFTPUpgrade]\\
You need a v10+ license code first! If you are an enterprise customer, contact us for your code. Its free if your maintenance is current.
CrushFTP v10 info: [/early10/Wiki.jsp?page=Update]\\
Version Date Modified Size Author Changes ... Change note
34 22-Apr-2024 15:52 2.982 kB Ben Spink to previous
33 22-Apr-2024 15:51 3.006 kB Ben Spink to previous | to last
32 22-Apr-2024 12:39 2.99 kB Ben Spink to previous | to last
31 22-Apr-2024 12:25 3.028 kB Ben Spink to previous | to last
30 22-Apr-2024 12:23 2.964 kB Ben Spink to previous | to last
29 19-Apr-2024 12:37 2.16 kB Ada Csaba to previous | to last
28 19-Apr-2024 12:36 2.157 kB Ada Csaba to previous | to last
27 19-Apr-2024 12:36 2.153 kB Ada Csaba to previous | to last
26 19-Apr-2024 12:34 2.604 kB Ada Csaba to previous | to last
25 19-Apr-2024 05:27 0.521 kB Ben Spink to previous | to last
24 19-Apr-2024 04:58 0.48 kB Ben Spink to previous | to last
23 28-Feb-2024 03:11 0.132 kB Ben Spink to previous | to last
22 28-Feb-2024 03:10 0.104 kB Ben Spink to previous | to last
21 27-Feb-2024 03:43 4.237 kB Ben Spink to previous | to last
« This page (revision-34) was last changed on 22-Apr-2024 15:52 by Ben Spink
G’day (anonymous guest)
CrushFTP11 | What's New

Referenced by
LeftMenu

JSPWiki