vBulletin 4.X Security Patch

Discussion in 'vBulletin Discussions' started by News Bot, Jul 19, 2011.

  1. News Bot

    News Bot Regular Member

    Apr 28, 2011
    Likes Received:
    Cyber Space
    vBulletin Publishing suite and Forum Classic

    • 4.1.4pl2
    • 4.1.3pl2
    • 4.1.2pl2
    • 4.1.1pl2
    • 4.1.0pl4
    • 4.0.8pl4
    • 4.0.7pl2
    • 4.0.6pl3
    • 4.0.5pl2
    • 4.0.4pl3
    • 4.0.3pl3
    • 4.0.2pl6
    • 4.0.1pl2
    • 4.0.0pl3
    Has been released.

    An additional flaw within a side query that is used in the search UI has recently been discovered. This is further to a previous patch that was issued. This flaw may enable malicious individuals to inject sql that would allow you to run arbitrary queries on the db via this exploit. To resolve this issue, it has been necessary to release a patch level version on all versions of vBulletin 4.X. The issue does not affect vBulletin 3.X to the best of our knowledge. We are not aware of a website that has been compromised by this flaw.

    The upgrade process is the same as previous patch level releases - simply download the patch from the Members Area, extract the files and upload to your webserver, overwriting the existing files. There is no upgrade script required.

    As with all security-based releases, we recommend that all customers upgrade as soon as possible in order to prevent any potential damage resulting from the flaw being exploited.

    Upgrading from 4.X

    If you are already running 4.X, the process you will be required to follow to make your board immune to this flaw is very simple.

    Visit the Patches section of the vBulletin Members' Area and download the patch for the version you are using, then extract the files from the archive you downloaded, then upload the files to your board via FTP etc., overwriting the existing files. This will update your version to the PL1 release.

    Thank you to user altex for reporting the issue to us.

    Continue reading...
  2. SpacewardAsh

    SpacewardAsh Lurking From Space

    Jan 2, 2011
    Likes Received:
    Falmouth, Cornwall, UK
    First Name:
    when are they going to learn to check, double check and triple check for such flaws before releasing their software, I think they need a new QA team...

Share This Page