vBSEO Security Bulletin - vBSEO 3.6.0 RC2 Released, Sitemap 3.0 PL1 Released, patches for older versions available

- vBSEO Security Bulletin -
vBSEO 3.6.0 RC2 Released, Sitemap 3.0 PL1 Released, patches for older versions available

Hello vBSEO customers and friends,

An exploit was recently brought to our attention and has necessitated the release of vBSEO 3.6.0 RC2, as well as patches for our older supported versions to protect your sites from the possible exploit. An update for the vBSEO Sitemap Generator is also available as Sitemap 3.0 PL1.

All customers are urged to upgrade/patch both their vBSEO core software and their vBSEO Sitemap software IMMEDIATELY to avoid any potential security issues with your forum.


Upgrading and Patching
All updates are available in the http://www.vbseo.com/downloads/ area.

Upgrading to 3.6.0 RC2
Follow the normal vBSEO upgrade process, as outlined in the ReadMe file in the docs folder.

Patching Older Versions
All available packages have been patched for future downloads, but it is not necessary to upload the entire package. Just FTP the patch files, overwriting their current location. There is no 'upgrade' script to run, nor will your version number change. Security patches are available for all customers, regardless of license status, on all currently supported product lines (3.3.0 +).

vBSEO 3.3.x Series : http://www.vbseo.com/attachments/f24...o_patch332.zip
vBSEO 3.5.x Series : http://www.vbseo.com/attachments/f24...bseo_patch.zip


3.6.0 Gold is right around the corner!
3.6.0 RC2 is our last planned RC release. All reported bugs have been fixed in RC2 since the release of RC1. Several new "Like" feature enhancements have also been added. If you missed RC1, please see the RC1 release notes: vBSEO 3.6.0 Release Candidate 1 available for Licensed Customers! for more details about the 3.6 series.

End of life for vBSEO 3.3.x
Reminder: With 3.6 Gold, the vbseo 3.3.x series will officially reach End of Life. As such, we anticipate this will be the last update to the 3.3.x series. It will no longer be maintained, updated, or supported. We encourage everyone to upgrade to at least 3.5.x series if you are still running older packages.



Thank you,

The vBSEO Team

How will we know if we were affected?

I upgraded today, but while doing so, I noticed a new folder on my server called: VBSEO_SITEMAP_DAT_FOLDER (or something like that) I have already deleted that folder (it was empty inside)

Thanks, upgraded both with no major issues. Hoping someone might be able to assist with this small one though.

In VB4 I use this css modification

vB4 Signatures and white space between posts

to reduce the space between the users post and the signature. It displays like this :



After a user clicks Like now, the signature drops down to the location it is on the default vb4 installation and creates all the white space.



Any ideas how I can stop it creating all that space ?

Originally Posted by hornstar6969

How will we know if we were affected?

I upgraded today, but while doing so, I noticed a new folder on my server called: VBSEO_SITEMAP_DAT_FOLDER (or something like that) I have already deleted that folder (it was empty inside)

You can delete that folder. It is not necessary, and its not a 'hack' either.

There's no good way to tell if you've been 'hacked' or not, as the exploit was an XSS flaw, which means that it was possible to inject anything javascript related into a certain low-traffic moderation area only. Odds are, if you haven't approved/modded any linkbacks in a while via the modcp/ area, you are clean.
That said, it's impossible to say what any script may or could have done.

I might check out my linkbacks later as I have not moderated those in quite some time.

Originally Posted by graham_w

Any ideas how I can stop it creating all that space ?

It doesn't 'create' space so much as it attaches it self via the DOM to the bottom tool bar.
You will need to edit the DOM hook for whatever your mod does to break the vb default grid layout.

Originally Posted by Brian Cummiskey

It doesn't 'create' space so much as it attaches it self via the DOM to the bottom tool bar.
You will need to edit the DOM hook for whatever your mod does to break the vb default grid layout.

Ok - i'll ask my question another way. How would one make the likes bar display directly under the post text, instead of attaching itself to the bottom tool bar ?

I would like it to display like this



Instead of like this as it currently does



The mod I posted is a simple css change which already looks after bringing the sig line up from the bottom tool bar. Perhaps there is a css change that can be made that is similar that will bring the likes bar up from the toolbar and will display it as I am after ?

The likes system is css-based as well. Check the vbseo css templates to see if you can find a similar action to match what that mod does. I'm unfamiliar with the mod, so I can't tell you what it does or how to mimic it.

Turns out editing vbseo_buttons.css and changing clear: both; to clear: none; under .vbseo_buttons .vbseo_liked does what I wanted! Didn't realise that it was all controlled by css Thanks for your help.

Thanks.. Going to upgrade now.

I get for the 3.5 patch invalid attachment link? Anybody else?

It is working correct for me. Make sure you are trying to download with your customer account. Patch is only available for vBSEO Customers.

for the sitemap, we have to re-up all files and re-install ? or we can patch it?

We advise to replace all files

Originally Posted by Mert Gökçeimam

It is working correct for me. Make sure you are trying to download with your customer account. Patch is only available for vBSEO Customers.

Doh, changed my email so i was unactivated