Previous Thread
Next Thread
Print Thread
Hop To
Joined: Jun 2011
Posts: 112
Sysop
OP Offline
Sysop
Joined: Jun 2011
Posts: 112
The UBB.threads development team has identified a serious exploit that can allow a standard user to obtain elevated permissions on UBB.threads forums and upload malicious files.

To protect yourself from the vulnerability, patches must be immediately applied if you are running version 7.3 and later. Patches for each version are now available for download in the member’s area of UBBCentral.com:

https://www.ubbcentral.com/members/members.php

To apply the patch upload the files provided in the patch to the appropriate directories in the UBB.threads installation on your server, overwriting the existing files.

Special thanks to Sirdude, gliderdad, Ruben and Gizmo for their assistance.

Last edited by UBBSystems; 09/24/2011 11:15 AM.
Joined: Jan 2004
Posts: 2,474
Likes: 3
D
Pooh-Bah
Offline
Pooh-Bah
D
Joined: Jan 2004
Posts: 2,474
Likes: 3
EDIT - never mind - I downloaded the wrong folder wink

Last edited by driv; 09/24/2011 9:43 AM.
Joined: Jun 2011
Posts: 112
Sysop
OP Offline
Sysop
Joined: Jun 2011
Posts: 112
No full upgrade, just upload the files over the old ones.....

Joined: Jun 2006
Posts: 81
M
member
Offline
member
M
Joined: Jun 2006
Posts: 81
Patched. grin

Thanks.

Joined: Mar 2008
Posts: 262
enthusiast
Offline
enthusiast
Joined: Mar 2008
Posts: 262
Patched our board a few min ago, Thanks!


Ian
http://www.firstgenmc.com/ubbthreads

"Experience is a hard teacher because she gives the test first, the lesson afterwords."
Joined: Jun 2006
Posts: 16,185
Likes: 102
UBB.threads Developer
Offline
UBB.threads Developer
Joined: Jun 2006
Posts: 16,185
Likes: 102
And thanks to our "identifying sites" for allowing us all to parade through their logs and test patches wink.

For those of you who had me install the patches for you, you're set, patched as issues where discovered. For those whom I provided DATA on HOW to patch, you'll need to apply the patch from the members area.


I am a Web Development Contractor, I do not work for UBBCentral. I have provided free User to User Support since the beginning of these support forums.
Do you need Forum Install or Upgrade Services?
Forums: A Gardeners Forum, Scouters World
UBB.threads: UBBWiki, UBB Styles, UBB.Sitemaps
Longtime Supporter & Resident Post-A-Holic
VNC Web Services: Code Modifications, Upgrades, Styling, Coding Services, Disaster Recovery, and more!
Joined: Mar 2007
Posts: 273
Likes: 1
E
Enthusiast
Offline
Enthusiast
E
Joined: Mar 2007
Posts: 273
Likes: 1
I downloaded 12-ubbthreads-7-5-6p1 (I have ver. 7.5.6) - Do I upload the _MACOSX Directory? (I don't have one now)

Bill

Joined: Jun 2006
Posts: 1,344
G
veteran
Offline
veteran
G
Joined: Jun 2006
Posts: 1,344
I dont see a _MACOSX Directory. There should be 4 directories: admin, languages, libs, and scripts

Joined: Oct 2009
Posts: 20
B
stranger
Offline
stranger
B
Joined: Oct 2009
Posts: 20
Originally Posted by ECNet
I downloaded 12-ubbthreads-7-5-6p1 (I have ver. 7.5.6) - Do I upload the _MACOSX Directory? (I don't have one now)

Bill


No, it's for MacOSX servers only wink

Joined: Jun 2011
Posts: 112
Sysop
OP Offline
Sysop
Joined: Jun 2011
Posts: 112
The _MACOSX can be ignored, we updated the downloads so it's not there anymore....


Joined: Mar 2007
Posts: 273
Likes: 1
E
Enthusiast
Offline
Enthusiast
E
Joined: Mar 2007
Posts: 273
Likes: 1
Originally Posted by gliderdad
I dont see a _MACOSX Directory. There should be 4 directories: admin, languages, libs, and scripts
I count 3 .DS_Store files.. Are those needed?


Nevermind, looks like a new version has just been posted without the _MACOSX directory and .DS_Store Files.

smile
Bill

Last edited by ECNet; 09/24/2011 3:47 PM. Reason: added last part
Joined: Mar 2007
Posts: 273
Likes: 1
E
Enthusiast
Offline
Enthusiast
E
Joined: Mar 2007
Posts: 273
Likes: 1
Originally Posted by UBBSystems
The _MACOSX can be ignored, we updated the downloads so it's not there anymore....
Thanks,

I missed seeing your post before.

laugh

Joined: Dec 2003
Posts: 6,467
Likes: 70
Offline
Joined: Dec 2003
Posts: 6,467
Likes: 70
Originally Posted by ECNet
Originally Posted by UBBSystems
The _MACOSX can be ignored, we updated the downloads so it's not there anymore....
Thanks,

I missed seeing your post before.

laugh
Bill, they cleaned up the patch files. So just ftp them up to your site and overwrite the script files by folder. It is just a couple.


Blue Man Group
There is no such thing as stupid questions. Just stupid answers
Joined: Feb 2007
Posts: 1,292
Likes: 2
Veteran
Offline
Veteran
Joined: Feb 2007
Posts: 1,292
Likes: 2
Well, It would be nice if I still HAD access to the members area since my subscription ran out waiting for the NEW RELEASE of v8!!!

Joined: Jun 2006
Posts: 1,344
G
veteran
Offline
veteran
G
Joined: Jun 2006
Posts: 1,344
Originally Posted by JAISP
Well, It would be nice if I still HAD access to the members area since my subscription ran out waiting for the NEW RELEASE of v8!!!


You should still be able to login and get the patch if your subscription ran out!

Joined: Apr 2007
Posts: 120
A
member
Offline
member
A
Joined: Apr 2007
Posts: 120
Naw, I also had to pay up, to get to the files.

And am now awaiting a bit of help, as I'm part way through the upgrade. smile


...usin' da classic UBB, since the beginning of time.
wink
Joined: Feb 2007
Posts: 1,292
Likes: 2
Veteran
Offline
Veteran
Joined: Feb 2007
Posts: 1,292
Likes: 2
Never had been able to in the past. If your subscription ran out you had zero access. Now if it was so important they should just make that file available to those whom they emailed by clicking a link in the email just as they had a link for the members area.


Joined: Jan 2008
Posts: 514
addict
Offline
addict
Joined: Jan 2008
Posts: 514
updated here.

Joined: Jun 2006
Posts: 106
member
Offline
member
Joined: Jun 2006
Posts: 106
Once I found it, it was smooth as silk.

(Look for the patch on the right side of the member area download page. Not the left! :face palm:)

Joined: Dec 2005
Posts: 122
member
Offline
member
Joined: Dec 2005
Posts: 122
ahem:

Code
UBB Message
We encountered a problem. The reason reported was

Database error only visible to forum administrators

Please click back to return to the previous page. 
my system is now dead.





JakChat.com -- Forums for Indonesia's English-speaking community
Ubuntu-Indonesia.com -- Forums for Indonesia's Ubuntu Users
Joined: Jun 2011
Posts: 112
Sysop
OP Offline
Sysop
Joined: Jun 2011
Posts: 112
send a support ticket in....

Joined: Dec 2005
Posts: 122
member
Offline
member
Joined: Dec 2005
Posts: 122
Originally Posted by UBBSystems
send a support ticket in....

i would, except (a) my membership seems to have been foreshortened by a year, and (b) i fixed it myself. mind you, i can think of better things to do with my time while sitting on the beach in Kuta, Bali.


JakChat.com -- Forums for Indonesia's English-speaking community
Ubuntu-Indonesia.com -- Forums for Indonesia's Ubuntu Users
Joined: Mar 2007
Posts: 522
Addict
Offline
Addict
Joined: Mar 2007
Posts: 522
Patched.


Steve

UBB.classic from 2000-2003
UBB.threads from 2003-present!
Joined: Jun 2011
Posts: 112
Sysop
OP Offline
Sysop
Joined: Jun 2011
Posts: 112
After further research and review we have issued a p2 patch to further enhance security. Owners that have not patched yet can use the p2 patch directly. If you have already patched using p1, please update to p2 the same way you applied p1.

To discuss upgrade and patching options, view this thread:

https://www.ubbcentral.com/forums/u...to-upgrade-or-patch-that-is-the-question

Joined: Jun 2006
Posts: 106
member
Offline
member
Joined: Jun 2006
Posts: 106
Up to date! Thanks!

Joined: Mar 2007
Posts: 522
Addict
Offline
Addict
Joined: Mar 2007
Posts: 522
Re-patched!


Steve

UBB.classic from 2000-2003
UBB.threads from 2003-present!
Joined: Dec 2003
Posts: 6,467
Likes: 70
Offline
Joined: Dec 2003
Posts: 6,467
Likes: 70
There was a lingering security hole that SD was not comfortable with.
So hence the second patch update.
I am happy to say paranoia does help on occasion.


Blue Man Group
There is no such thing as stupid questions. Just stupid answers
Joined: Mar 2008
Posts: 262
enthusiast
Offline
enthusiast
Joined: Mar 2008
Posts: 262
Re-Patched as well. Keep up the good work guys!

BTW is there anything we can see with this patch other than the updated version number at the bottom of the page?

Last edited by Iann128; 09/26/2011 8:11 PM.

Ian
http://www.firstgenmc.com/ubbthreads

"Experience is a hard teacher because she gives the test first, the lesson afterwords."
Joined: Jun 2006
Posts: 1,344
G
veteran
Offline
veteran
G
Joined: Jun 2006
Posts: 1,344
What do you mean?

Joined: Jan 2008
Posts: 514
addict
Offline
addict
Joined: Jan 2008
Posts: 514
I re-patched but seems that it still says... 7.5.6p1... is that accurate even with the p2 patch?


Dunny

Joined: Jun 2006
Posts: 1,344
G
veteran
Offline
veteran
G
Joined: Jun 2006
Posts: 1,344
You sure you patch it with the 7.5.6p2 and upload all the files?

Last edited by gliderdad; 09/27/2011 9:19 AM.
Joined: Jun 2006
Posts: 16,185
Likes: 102
UBB.threads Developer
Offline
UBB.threads Developer
Joined: Jun 2006
Posts: 16,185
Likes: 102
There aren't any "enhancements" to UBB.Threads 7.5.6 other than the security fixes; which won't be visible as it's all backend.


I am a Web Development Contractor, I do not work for UBBCentral. I have provided free User to User Support since the beginning of these support forums.
Do you need Forum Install or Upgrade Services?
Forums: A Gardeners Forum, Scouters World
UBB.threads: UBBWiki, UBB Styles, UBB.Sitemaps
Longtime Supporter & Resident Post-A-Holic
VNC Web Services: Code Modifications, Upgrades, Styling, Coding Services, Disaster Recovery, and more!
Joined: Mar 2008
Posts: 262
enthusiast
Offline
enthusiast
Joined: Mar 2008
Posts: 262
Thanks Gizmo


Ian
http://www.firstgenmc.com/ubbthreads

"Experience is a hard teacher because she gives the test first, the lesson afterwords."

Link Copied to Clipboard
ShoutChat
Comment Guidelines: Do post respectful and insightful comments. Don't flame, hate, spam.
Recent Topics
You've already posted
by Baldeagle - 08/06/2022 1:12 PM
Default Group(s) for New Members
by Morgan - 08/02/2022 10:54 AM
Webhook to DISCORD
by TGCsanderson - 08/01/2022 6:42 AM
Is it possible to restore a single forum from backup?
by Baldeagle - 07/19/2022 1:18 PM
Who's Online Now
0 members (), 72 guests, and 72 robots.
Key: Admin, Global Mod, Mod
Random Gallery Image
Latest Gallery Images
Los Angeles
Los Angeles
by isaac, August 6
3D Creations
3D Creations
by JAISP, December 30
Artistic structures
Artistic structures
by isaac, August 29
Stones
Stones
by isaac, August 19
Powered by UBB.threads™ PHP Forum Software 7.7.5