IP.Board 3.3.x-3.4.x and IP.Gallery 4.2.x-5.0.x Security Update

[[R] NuclearGeneral]

We are releasing security patches for IP.Board 3.3.4, IP.Board 3.4.5, IP.Gallery 4.2.1 and IP.Gallery 5.0.5 to address four cross-site scripting issues recently reported to us.

 

It has come to our attention that an unpatched security issue exists in a third party script included with the IP.Board release called "Flowplayer". While this script is included with IP.Board, it is presently only utilized by IP.Gallery to facilitate embedding of certain media files when the administrator allows them to be uploaded. The exploit that has been reported to us may expose a specific type of cross-site scripting vulnerability through Flowplayer and requires a certain level of user-interaction to trigger (in other words, a user must follow a link to the affected target - to our knowledge this issue cannot be triggered automatically by viewing a page normally accessible through typical navigation of the software).

It has come to our attention that an unpatched security issue exists in a third party script included with the IP.Board release called "swfupload". The cross site scripting vulnerability, like the one described above, requires a user to visit a specially crafted link to the swfupload flash file directly, where-by arbitrary javascript may be executed.

It has come to our attention that two potential cross site scripting vulnerabilities exist within the IP.Board editor routines. These vulnerabilities are not persistent (meaning you can only trigger them against yourself, as opposed to causing them to be stored in the database and triggered against another user), however we feel that it is in the best interests of our clients to release an update to address the issues reported.


We are releasing patches today to address all four issues.

 

To apply the patch, please perform the following steps:

• Identify which version of IP.Board you are running. If you are running IP.Board 3.3.x, you will also need to identify which version of IP.Gallery you are running.
• Download the appropriate patch file below
• Extract the contents locally on your computer
• Upload the contents of the "upload" folder to your forum root directory (where conf_global.php is located), overwriting any files when prompted. Please refer to this knowledgebase article if you are unfamiliar with using FTP to transfer files to your server.
• IF YOU ARE RUNNING BOARD 3.4.0 - 3.4.4, you will need to upgrade to 3.4.5, which as of today includes these patches.

 

If you are an IPS Community in the Cloud customer running IP.Board 3.3 or above, no further action is necessary; we have already automatically patched your account. If you are using a version older than IP.Board 3.3, you should contact support to upgrade.

 

If you are running IP.Board 3.4.x, please use the following zip:
http://community.invisionpower.com/filestore/public/style_extra/mime_types/zip.gif ipb3_4_and_gallery_5_0-9-13-2013.zip   79.87KB  2005 downloads

If you are running IP.Board 3.3.x without IP.Gallery, or with IP.Gallery 5.0.x, please use the following zip:
http://community.invisionpower.com/filestore/public/style_extra/mime_types/zip.gif ipb3_3_and_gallery_5_0-9-13-2013.zip   85.32KB  235 downloads

If you are running IP.Board 3.3.x with IP.Gallery 4.2.x, please use the following zip:
http://community.invisionpower.com/filestore/public/style_extra/mime_types/zip.gif ipb3_3_and_gallery_4_2-9-13-2013.zip   84.91KB  112 downloads

 

As of the time of this post, the full IP.Board and IP.Gallery packages in our client center have been updated.

If you are running any version of IP.Board or IP.Gallery that is not listed above, we recommend that you upgrade to the latest version to obtain these security fixes, as well as several other security and bug fixes.



We would like to thank Sahil Saif for bringing the flowplayer vulnerability to our attention.

We would like to thank Masato Kinugawa for bringing the swfupload vulnerability to our attention.

We would like to thank Jakub at http://hauntit.blogspot.com/ for bringing the editor vulnerabilities to our attention.

View the full article at IPS