Go Back   vb.org Archive > News and Announcements > News and Announcements
Reload this Page Urgent: XSS vulnerability in RC 2, 3 & 4 - fix available!
FAQ Community Calendar Today's Posts Search

Reply
Page 2 of 3 1 2 3
 
Thread Tools Display Modes
  #11  
Old 03-14-2004, 11:48 AM
Xenon's Avatar
Xenon Xenon is offline
 
Join Date: Oct 2001
Location: Bavaria
Posts: 12,878
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
just compare the old init.php to the new one and add the changes to your hacked one
Reply With Quote
  #12  
Old 03-14-2004, 12:19 PM
djohn djohn is offline
 
Join Date: Feb 2004
Posts: 165
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Is there any special software to do this?
Reply With Quote
  #13  
Old 03-15-2004, 01:23 PM
Xenon's Avatar
Xenon Xenon is offline
 
Join Date: Oct 2001
Location: Bavaria
Posts: 12,878
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
as mentioned on vbulletin.com

Beyond Compare by ScooterSoftware for example
Reply With Quote
  #14  
Old 03-18-2004, 02:12 PM
NTLDR's Avatar
NTLDR NTLDR is offline
Coder
  
Join Date: Apr 2002
Location: Bristol, UK
Posts: 3,644
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Two more files have XSS issues in them (forumdisplay.php and showthread.php). Patched versions can be found here http://www.vbulletin.com/forum/showp...94&postcount=4
Reply With Quote
  #15  
Old 03-18-2004, 03:32 PM
Sebastian's Avatar
Sebastian Sebastian is offline
 
Join Date: Oct 2002
Location: America
Posts: 488
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
wow lame. every single released vb3 version has had a security patch. i left phpbb due to security holes for nothing :P

thats what happens when you use those stupid 'globalize' arrays... thanks to those that run a server with register globals.. gg.
Reply With Quote
  #16  
Old 03-18-2004, 05:11 PM
Dean C's Avatar
Dean C Dean C is offline
 
Join Date: Jan 2002
Location: England
Posts: 9,071
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Well the globalize does it's best to clean data - it can only do so much though. Bare in mind the gold and first main release has not been released so you installed the beta's and release candidates at your own risk A security audit has been done in vB3 so you should see a lot less after gold
Reply With Quote
  #17  
Old 03-18-2004, 07:32 PM
Gio Takahashi's Avatar
Gio Takahashi Gio Takahashi is offline
 
Join Date: Jul 2003
Location: Cape Coral
Posts: 250
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Quote:
wow lame. every single released vb3 version has had a security patch. i left phpbb due to security holes for nothing :P

thats what happens when you use those stupid 'globalize' arrays... thanks to those that run a server with register globals.. gg.
Well vB3 was still in its beta. ITs something that is really expected. Aftregold its rare.
Reply With Quote
  #18  
Old 03-18-2004, 08:10 PM
Sebastian's Avatar
Sebastian Sebastian is offline
 
Join Date: Oct 2002
Location: America
Posts: 488
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Quote:
Originally Posted by Dean C
A security audit has been done in vB3 so you should see a lot less after gold
nice audit.. it was done a few weeks ago and they just found this hole
Reply With Quote
  #19  
Old 03-18-2004, 09:32 PM
Link14716's Avatar
Link14716 Link14716 is offline
 
Join Date: Jun 2002
Location: Georgia, USA
Posts: 2,519
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
They never said they completed the audit, now did they?
Reply With Quote
  #20  
Old 03-18-2004, 09:38 PM
Brad Brad is offline
 
Join Date: Nov 2001
Posts: 4,765
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Bugs will always be found, no reason to get worked up over it.
Reply With Quote
Reply
Page 2 of 3 1 2 3

« Previous Thread | Next Thread »

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump


All times are GMT. The time now is 01:53 PM.

Contact Us - Archive - Top

Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.
X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.04133 seconds
  • Memory Usage 2,252KB
  • Queries Executed 11 (?)
More Information
Template Usage:
  • (1)SHOWTHREAD
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (1)ad_showthread_beforeqr
  • (1)ad_showthread_firstpost
  • (1)ad_showthread_firstpost_sig
  • (1)ad_showthread_firstpost_start
  • (2)bbcode_quote
  • (1)footer
  • (1)forumjump
  • (1)forumrules
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (1)navbar
  • (3)navbar_link
  • (120)option
  • (1)pagenav
  • (1)pagenav_curpage
  • (2)pagenav_pagelink
  • (10)post_thanks_box
  • (10)post_thanks_button
  • (1)post_thanks_javascript
  • (1)post_thanks_navbar_search
  • (10)post_thanks_postbit_info
  • (10)postbit
  • (10)postbit_onlinestatus
  • (10)postbit_wrapper
  • (1)spacer_close
  • (1)spacer_open
  • (1)tagbit_wrapper 
Phrase Groups Available:
  • global
  • inlinemod
  • postbit
  • posting
  • reputationlevel
  • showthread
Included Files:
  • ./showthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/functions_bigthree.php
  • ./includes/class_postbit.php
  • ./includes/class_bbcode.php
  • ./includes/functions_reputation.php
  • ./includes/functions_post_thanks.php 
Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • showthread_start
  • showthread_getinfo
  • forumjump
  • showthread_post_start
  • showthread_query_postids
  • showthread_query
  • bbcode_fetch_tags
  • bbcode_create
  • showthread_postbit_create
  • postbit_factory
  • postbit_display_start
  • post_thanks_function_post_thanks_off_start
  • post_thanks_function_post_thanks_off_end
  • post_thanks_function_fetch_thanks_start
  • post_thanks_function_fetch_thanks_end
  • post_thanks_function_thanked_already_start
  • post_thanks_function_thanked_already_end
  • fetch_musername
  • postbit_imicons
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • postbit_display_complete
  • post_thanks_function_can_thank_this_post_start
  • pagenav_page
  • pagenav_complete
  • tag_fetchbit_complete
  • forumrules
  • navbits
  • navbits_complete
  • showthread_complete