We are releasing security patches for IP.Board 3.3.4, IP.Board 3.4.5, IP.Gallery 4.2.1 and IP.Gallery 5.0.5 to address four cross-site scripting issues recently reported to us.

 

It has come to our attention that an unpatched security issue exists in a third party script included with the IP.Board release called "Flowplayer".  While this script is included with IP.Board, it is presently only utilized by IP.Gallery to facilitate embedding of certain media files when the administrator allows them to be uploaded.  The exploit that has been reported to us may expose a specific type of cross-site scripting vulnerability through Flowplayer and requires a certain level of user-interaction to trigger (in other words, a user must follow a link to the affected target - to our knowledge this issue cannot be triggered automatically by viewing a page normally accessible through typical navigation of the software).

It has come to our attention that an unpatched security issue exists in a third party script included with the IP.Board release called "swfupload".  The cross site scripting vulnerability, like the one described above, requires a user to visit a specially crafted link to the swfupload flash file directly, where-by arbitrary javascript may be executed.

It has come to our attention that two potential cross site scripting vulnerabilities exist within the IP.Board editor routines.  These vulnerabilities are not persistent (meaning you can only trigger them against yourself, as opposed to causing them to be stored in the database and triggered against another user), however we feel that it is in the best interests of our clients to release an update to address the issues reported.


We are releasing patches today to address all four issues.  

 

To apply the patch, please perform the following steps:

• Identify which version of IP.Board you are running.  If you are running IP.Board 3.3.x, you will also need to identify which version of IP.Gallery you are running.
• Download the appropriate patch file below
• Extract the contents locally on your computer
• Upload the contents of the "upload" folder to your forum root directory (where conf_global.php is located), overwriting any files when prompted. Please refer to

 

If you are an IPS Community in the Cloud customer running IP.Board 3.3 or above, no further action is necessary; we have already automatically patched your account. If you are using a version older than IP.Board 3.3, you should contact support to upgrade.
 

 

If you are running IP.Board 3.4.x, please use the following zip:
ipb3_4_and_gallery_5_0-9-13-2013.zip

If you are running IP.Board 3.3.x without IP.Gallery, or with IP.Gallery 5.0.x, please use the following zip:
ipb3_3_and_gallery_5_0-9-13-2013.zip

If you are running IP.Board 3.3.x with IP.Gallery 4.2.x, please use the following zip:
ipb3_3_and_gallery_4_2-9-13-2013.zip

 

As of the time of this post, the full IP.Board and IP.Gallery packages in our client center have been updated.

If you are running any version of IP.Board or IP.Gallery that is not listed above, we recommend that you upgrade to the latest version to obtain these security fixes, as well as several other security and bug fixes.



We would like to thank Sahil Saif for bringing the flowplayer vulnerability to our attention.

We would like to thank Masato Kinugawa for bringing the swfupload vulnerability to our attention.

We would like to thank Jakub at

Читать дальше

Прикрепил файлы. Рекомендую пропатчить форум, дабы избежать непонятных ситуаций со взломами..

PS: на нулл повлиять не должно.

на 3.4.5 без галереи какой патч ставить?

Самый верхний. Просто появятся некоторые файлы галереи, думаю это не страшно.

PS: на нулл повлиять не должно.

Поставил, форум 3.3.3 и галерея 4.2.1, все нормально, проблем нет. Спасибо.

извиняюсь, что спрашиваю в этой теме, но хотелось бы уточнить:

 

на 3.4.5 нулл мафии предыдущие патчи безопасности ставить не нужно, а вот этот нужно, так? если какой то из предыдущих нужно - откройте тайну 

Нужно ставить последние два вышедших патча

Respected, я совсем запутался...

 

этот

 (эта тема)

 

и вот этот?

Именно так

Respected, спасибо, надеюсь другим поможет данная информация