vb.org Archive - Urgent: XSS vulnerability in RC 2, 3 & 4

Page 1 of 3

Show 40 post(s) from this thread on one page

vb.org Archive (https://vborg.vbsupport.ru/index.php)

- News and Announcements (https://vborg.vbsupport.ru/forumdisplay.php?f=2)

- - Urgent: XSS vulnerability in RC 2, 3 & 4 - fix available! (https://vborg.vbsupport.ru/showthread.php?t=61537)

Erwin

02-14-2004 02:01 AM

Urgent: XSS vulnerability in RC 2, 3 & 4 - fix available!

From this announcement today by Kier at vB.com:
http://www.vbulletin.com/forum/showthread.php?t=95284

An XSS vulnerability has been discovered in vBulletin 3 and posted to BugTraq.

vBulletin 3 versions RC2, RC3 and RC4 are affected. This has necessitated the release of an updated version of includes/init.php to patch the problem.

The members' area package has been updated with this file.

If you are already running vBulletin 3 RC4, simply upload the attached init.php file to the 'includes' folder in your forum directory, overwriting the existing one.

If you are running a previous version of vBulletin 3, we recommend that you upgrade to the version of RC4 available in the members' area as soon as possible.

vBulletin 2.3.4 and earlier are not affected. Sites running vBulletin 2 need take no action.

Link to vB.com attachment: init.php
__________________

Chroder

02-14-2004 08:09 PM

Does the vulv still affect me if I don't have the external data providor features enabled? Or is that a totally different thing?

Xenon

02-14-2004 10:04 PM

it's a totally different thing.

the external data provieder is in the file external.php but the security hole is in init.php

Chroder

02-14-2004 10:14 PM

Can I still use the updated file if I'm using RC3? or do I have to upgrade to RC4? I'm waiting for gold before I do all my template-fixes. I don't want to do 'em twice.

Xenon

02-14-2004 10:15 PM

you just have to compare the files and apply the xss changes.

That's what we did on vb.org :)

Chroder

02-14-2004 10:17 PM

Quote:

Originally Posted by Xenon

you just have to compare the files and apply the xss changes.

That's what we did on vb.org :)

I just uploaded it over my RC3 init.php file and everything seems to be going smoothly. I'll compare them if something starts acting up.

Thanks :)

Chroder

02-15-2004 01:15 AM

Just a heads up that there's also a fix for search.php here

DCX	02-23-2004 06:26 AM

Quote:

Originally Posted by Chroder

Just a heads up that there's also a fix for search.php here

does this update just overwrite the forums/search.php file? i just wanna make sure before i overwrite something....

Tim Wheatley

02-23-2004 12:31 PM

Quote:

Originally Posted by DCX

does this update just overwrite the forums/search.php file? i just wanna make sure before i overwrite something....

Yeah just overwrite the init.php and search.php ones on your server with the ones made available. Note: any hacks installed within those files will need to have the code changes made again in those files.

djohn

03-13-2004 12:22 PM

Any way to upgrade manually? I remember chaging init.php whilst installing some hack...

All times are GMT. The time now is 05:36 PM.

Page 1 of 3

Show 40 post(s) from this thread on one page

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.01005 seconds Memory Usage 1,733KB Queries Executed 10 (?)
More Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (3)bbcode_quote_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)pagenav (1)pagenav_curpage (2)pagenav_pagelink (1)post_thanks_navbar_search (1)printthread (10)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start pagenav_page pagenav_complete bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages: