Aegir and SA-CORE-2014-005 Case:

- Aegir server 2.1 on Drupal 6.31
-- Platform Hostmaster: Drupal 6.31
--- Hostmaster: ?
-- Platform 1: Drupal 7.31
--- Site 1: HACKED
--- Site 2: HACKED
-- Platform 2: Drupal 7.32
--- Site 3: ?
--- Site 4: ?


Actions:


So the attackers get access on site 1 + site 2 using the SA-CORE-2014-005.
Platforms 1 and sites 1 and site 2 totally deleted or restored from an old backup and then updated (files and db).


Questions:


Is there a case that the hackers gain access on Hostmaster or on sites 3 and site 4?
Or even worst… the hackers gain that level of access on the server that can compromise a new Aegir install?
If site 1 and 2 are compromised, it's entirely possible that
sites 3 and 4 are either in danger of being compromised or have
already been compromised.
More or less, yes. If they already have sites 1 and 2, it's extremely likely that they can directly access your server.


You should consider your current server and the sites running on it as tainted and rebuild from scratch. Despite @Clive's assertion, there is no user account sandboxing happening at the per-site level.