MyBB 1.1.8 Released - Security Update
#1
Due to 3 low risk browser based cross-site scripting vulnerability found in MyBB, we're releasing a security update to the MyBB 1.1.x series. The vulnerabilities include:
We recommend all users upgrade their copy of MyBB to the latest available release.

The release on the MyBB site has also been updated to 1.1.8.

Update instructions are in the next post, including a list of changed files (and a ZIP archive of them) as well as manual patching instructions for those of you who have customized their code.

Beta testers running 1.2: You're only affected by the first vulnerability (IE specific). Please see the beta forum for an updated beta release.

Warning to web application developers:
The first vulnerability affects many web applications. You need to ensure that if you allow file uploads (such as images) that you're correctly checking the file upload type, the actual image type and the file extension.

The vulnerability is performed by spoofing the headers of an uploaded image and providing it with a different filename which causes Internet Explorer to locally execute any markup in the image.

You can read more at SecuriTeam - Microsoft Internet Explorer 6.0 Embedded Cross Site Scripting (GIF) and phpBB (and other BB systems) cookie disclosure exploit.
#2
Updating from 1.1.7 Using Changed Files (Recommended)
You must already be running MyBB 1.1.7 to perform this method!
  • Download the attached "mybb_118_changed_files.zip" from this post.
  • Upload the contents of it to your forums in the corresponding folders.
  • Check your Admin CP to confirm you are running 1.1.8
Updating from 1.1.7 Manually
You must already be running MyBB 1.1.7 to perform this method!
  • Download the attached "mybb_118_patch.txt" from this post.
  • Follow the manual patch instructions in the file replacing or adding code where necessary and uploading the files back up to your web site.
Updating from Previous Releases
Download the latest release from the MyBB web site and follow the general upgrade procedure. (Found in docs/upgrade.html)

Changed Files
  • admin/global.php
  • inc/functions.php (Version number change)
  • inc/functions_post.php
  • inc/functions_upload.php


Attached Files
.txt   mybb_118_patch.txt (Size: 3.16 KB / Downloads: 746)
.zip   mybb_118_changed_files.zip (Size: 24.36 KB / Downloads: 967)
#3
Discuss this announcement


Forum Jump:


Users browsing this thread: 1 Guest(s)