Quarantined?

Are there any more details on this and why it was quarantined?

thanks.

[vbresults]

Originally Posted by BirdOPrey5

Seriously Jacquii? I (and most of the rest of the staff) are here as volunteers. We are using our own time and energy to keep vBulletin modifications safe for everyone. Even confirming it is an exploit might give people ideas and risk the security of everyone who has this installed.

Regardless of the reason the e-mail contains the suggested course of action (disable the mod). I will not have any pity for those who received the email and chose to ignore it. If anyone is that interested in fixing the mod itself then review the code and fix any exploits you find- no one is stopping you. That goes for every mod here, quarantined or not.

A sort of mania appears to be setting in with this quarantine. It's like everyone's cat is lighting on fire. He probably doesn't mean what he said, even though it was a _______ bag thing to say.

[Adrian Schneider]

Wow guys. Any administration, developer, etc. worth a grain of salt will not give out (even potential) security vulnerabilities to harm their members. For those who are curious, you can find out by looking at the patch once it comes out or try finding it yourself prior.

There is no reason you need to know what the vulnerability is until it's been fixed. If you're concerned, disable the product. Simple.

Ugh, I feel for the staff here. Dealing with other admins or developers is the worst when they think they always know best.

Keep up the good work guys. The response you SHOULD be getting is a huge thanks for looking out for us.

Cheers

[souperman]

I agree 100% with Adrian on this. The reason why they're not saying much about this is because not many people know about the exploit, it's not even lurking on hack forums/sites. This mod can be exploited if they release details on this, the mods or mod owner need time to get this sorted. I know all of you want to be given a reason, but you guys need to understand that's not the best route at them moment. For now, disable the mod and remove all the php files associated with the mod.

[toastyman]

I totally get "don't give out what the actual exploit is", but the email didn't give us enough information to actually know what to do.

It didn't say that it was removed for security reasons at all. I couldn't tell if this was a "remove this now, it's urgent!" problem, a "the latest version that was uploaded by the author is breaking installs, we don't want people messing up their forum by continuing to download it" problem, or a copyright claim or whatever.

If it was removed for security reasons, is just disabling it enough? Do the files actually have to be removed because it's still exploitable even if the product is disabled? The email says "If the modification consists of a product then disabling the product should be all that is required.", but past security problems with mods has shown that not to always be true. The email follows up with "If the modification also included new files then you may remove (or rename) them." which seems to contradict that disabling is good enough.

The URL listed in the email sent out just linked to the thread with no information about the quarantine either.


I'm not trying to complain about the wonderful service you guys are doing, but trying to explain from the perspective of a recipient of the quarantine email why you're getting so much angst over it. It's kinda like the evening TV news saying "There's something in your kitchen that could kill you!" and not elaborating. A very vague warning about a mod without anything other than "it has been quarantined" raises way more questions than provides answers, and left me unsure what I really needed to do.


If I were writing the email, I'd say something more like:

Subject: Action needed - Security issue with ibProArcade - professional Arcade System

The ibProArcade - professional Arcade System modification has been 'quarantined' by vBulletin.org, due to a security issue that requires your immediate action to ensure your forum's security.

You downloaded this modification at the following thread, which has now been archived until further notice.

https://vborg.vbsupport.ru/showthread.php?t=101554

This modification has been quarantined due to a serious security issue that has been brought to our attention. Our policy is not to discuss security issues publicly. However, the author of the modification has been informed and asked to address the quarantine reason(s). Until this is done, the modification will remain in the vbulletin.org graveyard. Once the author has responded to the issues you will be notified that it has been restored.

With the information we have at the current time, we believe this security issue can be completely prevented by disabling the modification in your Admin Control Panel. Go to "Plugins & Products", then "Manage Products" then disable this modification.

We do not believe removing this modification's additional files (if any) or uninstalling it is necessary to prevent exploitation of the security issue. Please keep in mind that if you uninstall this modification anyway, you may delete any data associated with it.

Explain the problem, explain what's being done about it, and list what actions a forum owner needs to take a bit more authoritatively.

[vijayninel]

I completely support the vb.org staff's decision of not releasing additional details without a fix being developed and released first. Doing so will only make a hackers job easier and leave users of the mod more vulnerable.

[Bomyne]

Do i have to disable it in plugins/products or is using the mod's off switch enough?

EDIT Nevermind! Turning it off has no effect what so ever... I'll disable it.

Disabling it still leaves it accessable! What's going on?

[JacquiiDesigns]

Originally Posted by BirdOPrey5

Seriously Jacquii?

Yes. Seriously Joe.
If I wasn't serious - I likely wouldn't have posted it. And though the language I used may be a bit strong for the subject matter at hand.... The suggestion that members here who have installed a modification be given a weeee bit more info than, "exploit. disable mod until further notice" is as well. It's a solid idea and it's a strong idea and you can see that it's a valid idea by the bulk of commentary in this thread.

Also - FWIW - I appreciate very much the all volunteer staff here at vB.org - I always have and as long as my boards are running vBulletin = I always will.

But being an all volunteer staff isn't an excuse for providing little to absolutely-no information to the users of modifications here.

That's all - and hopefully my posts will inspire a conversation amongst the staff members regarding this ridiculous no-info-upon-graveyard policy. Specifically - how to better it so that the Jacquii's of the world won't have a reason to +++++ -- Drama queen? Not hardly. Someone curious about what the exploit is and why we're not given one iota of a detail regarding it? Sure.

J.

--------------- Added [DATE]1314696161[/DATE] at [TIME]1314696161[/TIME] ---------------

Originally Posted by Bomyne

Do i have to disable it in plugins/products or is using the mod's off switch enough?

EDIT Nevermind! Turning it off has no effect what so ever... I'll disable it.

Disabling it still leaves it accessable! What's going on?

Disabling it does indeed leave it accessible.
You should probably just turn the entire arcade off via Arcade Main Settings.
Perhaps to go a step further would be to rename your arcade.php file to something else until a fix is announced.

Of course such info might have been helpful if included in the super-useful quarantine email...

J.

[Bomyne]

Originally Posted by JacquiiCooke

--------------- Added [DATE]1314696161[/DATE] at [TIME]1314696161[/TIME] ---------------



Disabling it does indeed leave it accessible.
You should probably just turn the entire arcade off via Arcade Main Settings.
Perhaps to go a step further would be to rename your arcade.php file to something else until a fix is announced.

Of course such info might have been helpful if included in the super-useful quarantine email...

J.

Tried turning it off via the settings too. I can still play arcade games like that.

I think I'm going to chmod the arcade.php file to 000 or something.

[JacquiiDesigns]

Originally Posted by Lancerforhire

A sort of mania appears to be setting in with this quarantine. It's like everyone's cat is lighting on fire. He probably doesn't mean what he said, even though it was a _______ bag thing to say.

Okay - this post is useful to the thread how? IDK - but one thing to correct you on = I'm a she --- the "______" was for dramatic effect. So I suppose drama queen was appropriate. But even more appropriate than the name-calling, is the call to provide actual information in the "quarantine" email - otherwise the email is pretty useless to those of us who can read.

It has absolutely nothing to do with mania or anyone's cat lighting on fire, which is really a horrible thing lmao

--------------- Added [DATE]1314696627[/DATE] at [TIME]1314696627[/TIME] ---------------

Originally Posted by Bomyne

Tried turning it off via the settings too. I can still play arcade games like that.

I think I'm going to chmod the arcade.php file to 000 or something.

Only Admin group can access the arcade when disabled. Other usergroups will see "The administrator currently has the arcade disabled." message.

Rename arcade.php to something like blablabla.php -- something that only you will know -- and then once a fix has been posted - change the name back - then users browsing to your arcade.php file should be redirected to 404 error...?

[Bomyne]

Originally Posted by JacquiiCooke

--------------- Added [DATE]1314696627[/DATE] at [TIME]1314696627[/TIME] ---------------



Only Admin group can access the arcade when disabled. Other usergroups will see "The administrator currently has the arcade disabled." message.

Rename arcade.php to something like blablabla.php -- something that only you will know -- and then once a fix has been posted - change the name back - then users browsing to your arcade.php file should be redirected to 404 error...?

That explains it, Thanks.

I went one better. I inserted

die("This file is offline for now");

after the <?php

To the best of my knowege, that'll cause the file to fail to load but when an update is released, uploading it will automatically replace the file and save me the trouble of remembering to rename it back :P