ibProArcade v2.7.2+ coming

This version fixes the security-problem and will be released within the next 24 hours, after the staff here verified it is ok

[BirdOPrey5]

Originally Posted by MentaL

injection on arcade.php. Allowed a user to gain the MD5 and salt of any user it requested. best way to check if you are infected is to search for the following in your logs

Arcade&do=stats&comment=a&s_id=

If you find injection then follow it up.

For those not as tech minded it means a hacker could crack the password for any user on your site.

It would be a good idea to change the passwords of all admin accounts on your site if you had this mod installed.

[viper357]

Originally Posted by MentaL

injection on arcade.php. Allowed a user to gain the MD5 and salt of any user it requested. best way to check if you are infected is to search for the following in your logs

Arcade&do=stats&comment=a&s_id=

If you find injection then follow it up.

Sorry for the noob question but which logs must we look at and where do we find them? Thanks.

[MentaL]

Originally Posted by viper357

Sorry for the noob question but which logs must we look at and where do we find them? Thanks.

web server logs, cpanel users can find them in /home/username/logs

[Schoelle]

Thanks MentaL.
No entries in my logs.

[garyb12001]

Any updates as to when the new version might be released? Thanks!

[Mark.B]

Once again we have no updates to a critical modification. Mr Zeropage implies that the update is with vBulletin.org staff for verification. Could we at least have an update regarding timescales? If there's an issue than fair enough, but as usual with vb these days, we are simply left in the dark.

[PossumX]

Anxiously awaiting update Customer of mine is having a coronary over this, more so, his members ...

[Mark.B]

It would be nice for someone to update us on what on Earth is going on here.

I am not criticising the mod author here incidentally.

A statement has been made telling us to pull the most popular modification by many multiples. This then cripples many of our sites, or puts us at risk of being hacked.

A further statement is made stating that a patch has been made and will be released within 24 hours.

Two and a half days later - no patch, no further statement, abject silence from everyone.

If there's a delay in the patch because an issue has been found, then fine - but please tell us.

Instead, it seems everyone is content to hammer further nails into the coffin of forums, many of whom are already losing members to Facebook hand over fist.

We all gave our members an update and now WE look like we're the ones ignoring THEM, because vbulletin.org is ignoring US.

I am not complaining about the lack of a patch - I am complaining about the lack of updates.

[durruti]

Originally Posted by MentaL

web server logs, cpanel users can find them in /home/username/logs

Noob question, I can't really find what you're referring to but are you referring to Raw Access Logs?

[BirdOPrey5]

There was an SQL injection exploit identified for this mod.

After confirming it I quarantined the mod.

I have discussed the exploit with the mod author and am waiting for him to upload a fixed version.

I am keeping a close eye on this and hope to approve the update as quickly as I can once I get it.