***********************
vBSEO SECURITY BULLETIN
***********************
November 17, 2009
A possible exploit was reported today by a big-board
vBSEO customer.
After some testing with our development team, we were able to narrow
down a case of possible malicious code injection through a legacy code
bit in
vbseo. The legacy code has been removed from the new versions
released herein.
This issue effects ALL versions of
vBSEO on forums that use the file
system to store attachments/avatars/profile pics/etc. ALL customers
using file system storage are urged to upgrade as soon as possible.
All packages have been updated with the patch in the downloads area
(
https://www.vbseo.com/downloads/). There is no version number change.
You may simply over-write your current version files with those in the
download package and follow the *upgrade* instructions included in
docs/readme.html file, or you can apply a patch from the list below.
***Applying the Patch***
Please download the file that correlates to your installed version and
follow the instructions below:
Patch for
vBSEO 3.3.2:
http://www.vbseo.com/attachments/f24...-3-2_patch.zip
Patch for
vBSEO 3.3.1:
http://www.vbseo.com/attachments/f24...-3-1_patch.zip
Patch for
vBSEO 3.3.0:
http://www.vbseo.com/attachments/f24...-3-0_patch.zip
Patch for
vBSEO 3.2.0:
http://www.vbseo.com/attachments/f24...-2-0_patch.zip
vBSEO versions 3.1 and older have met End Of Life and will not be
patched in this or future updates. If you are on a version older than
vBSEO 3.2.0, you should upgrade to at least
vBSEO 3.2 (latest, 3.3.2
recommended).
***Installing the Patch***
Advanced users:
- FTP the files, overwriting current installation files.
Step by Step:
- Download the correct patch for your board's
vBSEO version from the
link above.
- Extract the archive with an un-zip tool.
- Upload entire contents of the folder to your vBulletin installation
folder, allowing for overwrite within your FTP client to replace
current files.
- There is no upgrade script, product to install, .htaccess file
changes, or config file changes needed with this patch.
***Need Help?***
If you have any questions about upgrading or patching your install,
please create a support ticket:
vBSEO.com Helpdesk. Our
staff are standing by to help should you run into a problem.
Your security is our priority,
The
vBSEO Team