vBulletin 3.6.7 Nulled By CNETeam Released

Тема в разделе "Скрипты", создана пользователем (SX), 17 май 2007.

Информация :
Уважаемые пользователи если Вы ищите скрипт, то создайте тему в соответствующем разделе "Коммерческие" или "OpenSource"
В данном разделе создавать темы с префиксом"ИЩУ" запрещено.
Статус темы:
Закрыта.
Модераторы: DMS
  1. (SX)

    (SX) Прохожие

  2. Avalanch

    Avalanch ТоЛеГ & ТоПеГ

    Регистр.:
    9 янв 2007
    Сообщения:
    1.138
    Симпатии:
    524
    Список изменений в версии 3.6.7:

    vBulletin 3.6.7

    The 3.6.7 package has been updated as of 18:30 UTC, May 16th 2007

    As much as we hate to spring another upgrade on you all so soon after the release of vBulletin 3.6.6, an XSS flaw was identified today and in order to maintain our commitment to fix security problems as soon as we become aware of them, we have to release 3.6.7 and a patch for older versions.

    All versions of vBulletin 3.6 prior to 3.6.7 are vulnerable to the XSS. vBulletin 3.5.x and 3.0.x are not affected.

    To minimize the pain of another upgrade, there are no changed templates since 3.6.6 and no database schema changes, so the upgrade should be as simple and quick as possible.

    Since we have fixed several bugs since vBulletin 3.6.6 was released, these fixes are also incorporated in this version and include amongst others:
    • Перейти по ссылке
    • Перейти по ссылке
    • Перейти по ссылке
    • Перейти по ссылке
    • Перейти по ссылке
    • Перейти по ссылке.

      Please accept our apologies for bringing out a new version just days after the previous release. We're sorry.

      Fixing the XSS Bug

      The XSS problem can be resolved in one of three ways.
      1. Full Upgrade: The best way to fix the problem is to perform a full upgrade, downloading the complete 3.6.7 package from the Перейти по ссылке. This is the only option that will not only fix the XSS issue, but will also apply all the bug fixes made since the release of 3.6.6.
      2. Patch: A second option is to download the patch files either in the Перейти по ссылке or attached to this thread and upload them to your web server, overwriting the existing files.
        Patch file: 366_patch.zip
      3. Plugin: The plugin system built into vBulletin 3.6 allows the problem to be fixed with a simple plugin. The install file for this plugin is also attached to this thread and is the easiest way to fix the problem, as it does not require you to upload any files via FTP. The plugin will be automatically removed when you perform your next full upgrade. You can install the plugin by following the instructions Перейти по ссылке.
        Plugin File: vb_calendar366_xss_fix_plugin.xml
      Please note the following:
      • The plugin can be used with any previous version of vBulletin 3.6
      • The patch can only be applied to vBulletin 3.6.4, 3.6.5 or 3.6.6
      • You may perform a full upgrade to vBulletin 3.6.7 from any previous version of vBulletin 3.
      Files Changed Since 3.6.6
      The following is a list of files changed since 3.6.6.
      • /
        • calendar.php
        • editpost.php
        • newthread.php
      • admincp/
        • adminpermissions.php
        • clear.gif - added
        • options.php
        • phrase.php
        • profilefield.php
        • usertools.php
        • global.php
      • clientscript/
        • vbulletin_date_picker.js
        • vbulletin_quick_reply.js
        • vbulletin_textedit.js
      • cpstyles/
        • vBulletin_2_Default/calendar_popup.png - added
        • vBulletin_3_Default/calendar_popup.png - added
        • vBulletin_3_Frontend/calendar_popup.png - added
        • vBulletin_3_Manual/calendar_popup.png - added
        • vBulletin_3_Silver/calendar_popup.png - added
      • includes/
        • adminfunctions.php
        • adminfunctions_help.php
        • class_bbcode.php
        • class_core.php
        • class_dbalter.php
        • class_dm_user.php
        • class_postbit.php
        • functions_databuild.php
        • version_vbulletin.php
        • cron/attachmentviews.php
        • cron/threadviews.php
      • install/ - all changed
      __________________

      Several people have asked both on the forums and in the support ticket system for exact details of the changes to the FORUMHOME and navbar templates between 3.6.5 and 3.6.6/7, so here they are:

      navbar

      Remove this code completely: HTML Code:
      <script type="text/javascript"><!--function log_out(){ ht = document.getElementsByTagName("html"); ht[0].style.filter = "progid:DXImageTransform.Microsoft.BasicImage(grayscale=1)"; if (confirm('$vbphrase[sure_you_want_to_log_out]')) { return true; } else { ht[0].style.filter = ""; return false; }}//--></script>
      Then find this code HTML Code:
      onclick="return log_out()"
      and replace it with this code HTML Code:
      onclick="return log_out('$vbphrase[sure_you_want_to_log_out]')"
      FORUMHOME

      Find this code HTML Code:
      onclick="return log_out()"
      and replace it with this code HTML Code:
      onclick="return log_out('$vbphrase[sure_you_want_to_log_out]')"

      __________________

      It would appear that the XSS that necessitated the release of 3.6.7 extends to another system we did not appreciate at the time of the release.

      Therefore, here are a further set of patches and plugins for you to apply.

      Here are your options, depending on the version of vBulletin you are currently running.

      Currently running vBulletin 3.6.7
      Either:
      • Download the patch for 3.6.7 from the Перейти по ссылке (or this thread - 367_patch.zip) and upload the contents to your forum directory
        or
      • Apply the plugin vb_367_xss_fix_plugin.xml attached to this thread
      Those using vBulletin 3.6.7 can make use of the new Patch Level release system, which allows the correct version number to be displayed in the admin control panel - with the patch applied, your version number in the ACP will reflect the fact that you are now running 3.6.7 PL1.

      Currently running vBulletin 3.6.4, 3.6.5 or 3.6.6
      Either:
      • Upgrade to the new vBulletin 3.6.7 package available in the Перейти по ссылке
        or
      • Download the patch for 3.6.6 available in the Перейти по ссылке (or this thread - 366_patch.zip) and upload the contents to your forum directory
        or
      • Apply the plugin vb_366_xss_fix_plugin.xml attached to this thread
      Currently running vBulletin 3.6.x older than 3.6.4
      Either:
      • Upgrade to the vBulletin 3.6.7 package available in the Перейти по ссылке
        or
      • Apply the plugin vb_366_xss_fix_plugin.xml attached to this thread
      Once again, we are sorry that this latest problem has occurred. We are looking into ways to ensure that this sort of thing does not happen again.


      Ссылка на тему: Перейти по ссылке

     
  3. SNap!

    SNap! Прохожие

    POOR Contains some Callbacks & Hotlinks so dont use !!!
     
  4. Aradan

    Aradan Создатель

    Регистр.:
    28 авг 2006
    Сообщения:
    30
    Симпатии:
    1
    на рапиде уже удалили!
     
  5. Avalanch

    Avalanch ТоЛеГ & ТоПеГ

    Регистр.:
    9 янв 2007
    Сообщения:
    1.138
    Симпатии:
    524
    Перейти по ссылке - здесь все остальные нуллы от других команд.
    Лично я благосклонен больше к vbsupport.org
     
Статус темы:
Закрыта.