vBulletin v. 3.7.4 Security Fix

alexD

New Member
There was a xss flaw found in the newest 3.7.x release so vbulletin.com and .org posted the security fix. This is for those of you who do not wish to reinstall the new 3.7.4 sp1 which will be out shortly. This will fix the know issuses with this version of vbulletin forum software.

Here is the release info from vbulletin.com(minus the links)

vBulletin 3.7.4 PL1

An XSS flaw within the user control panel has recently been discovered. This could allow an attacker to carry out an action as a user or obtain access to a user's account. To resolve this issue, it is necessary to release a patch level version of vBulletin 3.7.4.

vBulletin 3.6 is not affected. vBulletin 3.8 is affected, and the next beta/release candidate will include the fix.

The upgrade process is the same as previous patch level releases - simply download the patch from the Members Area, extract the files and upload to your webserver, overwriting the existing files. There is no upgrade script required.

As with all security-based releases, we recommend that all customers upgrade as soon as possible in order to prevent any potential damage resulting from the flaw being exploited.


Upgrading from 3.7.4

If you are already running 3.7.4, the process you will be required to follow to make your board immune to this flaw is very simple.

There is no need to run an upgrade script if you are already running 3.7.4.

Download the patch for 3.7.4, then extract the files from the archive you downloaded, then upload the files to your board via FTP etc., overwriting the existing files. This will update your version to the PL1 release.



Upgrading from Versions Earlier than 3.7.4

If you are not already running 3.7.4, you should download the latest version from vBTEAM and perform an upgrade as normal.

Full instructions for upgrading vBulletin are available in the releases installation instructions.
 

alexD

New Member
Sorry about that it does state in the info above but let me clear this up. You install the files where they are already in side of your forum(or what ever name you named it) folder and you over write them if your using ftp or if its a localhost then replace them with the new files and your forum will be fixed of course you can always do the re-install with the sp1 for 3.7.4 which should be out soon.

Enjoy the fix!

~alexD
 

alexD

New Member
One more thing this flaw is in 3.8.0 beta versions and if your upgradeing to the beta`s soon please wait till the next beta or rc1 because they have stated that they will change the files in the next beta or if it is near stable rc1.
 

alexD

New Member
Your all welcome, just trying to help out since its the holiday season I cant be on for the next few days yes this will fix 3.7.4, they havent nulled the latest version yet and beta 4 is out but till now enjoy the fix.
 

SkinDz

New Member
Thank you alexD
icon12.gif
 

gizmix

New Member
thanks for the guidance.

i know this is slightly old but i need 3.7.4 because thats the version of the database i need to back up! many thanks for informing us.
 
Top