vbfans.com - WTN Official Products / Services

WTN.Patch: vBulletin 3.8.6 [faq.php]

Floris — Wed, 21 Jul 2010 17:25:37 GMT

We believe the following should be enough to patch a 3.8.6 board that's vulnerable to the faq.php exploit that a buddy of ours found today and made aware to vBulletin.com

Installation instructions.

Since all you need to do is hook into vBulletin via global.php and delete the phrase from the language, the following should be enough:

Put it in wtn_386_patch.php

Upload to forum directory

Run from browser

Remove from forum directory

And test if you're still vulnerable.

wtn_386_patch.php

PHP Code:


		
			
// wtn_386_patch.php

error_reporting(E_ALL & ~E_NOTICE & ~8192);

require_once('./global.php');

$db->query_write("DELETE from " . TABLE_PREFIX . "phrase WHERE varname = 'database_ingo'");

echo "Done";

?>

Please note that we're still testing, rebuilding languages might be required, but I don't believe that's needed.

If rebuild is required, perhaps add

require_once(DIR . '/includes/adminfunctions.php');
after require global
and then before echo on a new line
build_options();
build_language(0);
build_language_datastore();

But I haven't had time to test that yet. I got flaky internet tonight and am preparing dinner :p

WTN.Product: Report User

Floris — Wed, 26 May 2010 15:17:04 GMT

Hello everybody,

This is an official wetalk.network (WTN) product for vBulletin version 3.8, called: Report User

This is the official thread, from where one can get access to the downloads, as well as official support.

It adds the ability to vBulletin 3.8 to report a user (and not just their content) from various places throughout the vBulletin system, starting with their profile.

And here's our roadmap:

Version 1.0

- May 2010: Internal Build, proof of concept
This version will be available via our staff forums only, to find the show stoppers and get some basic features covered.

- June 2010 - Development

- July 2010: Premium Build, first beta
This version will be available via our WTN forums only, a private beta test for all our premium members.

- Early August 2010: WTN Build, release candidate
This version will be available via our WTN forums only, a public beta test (release candidate rather) for all our registered members.

- Late August 2010: vBorg Build, stable
This version will be available via our WTN forums, and the vBulletin.org community, a public release we consider 'gold'.

- September 2010: Maintenance Build, stable
This version is like the vBorg build, but will only have maintenance / security fixes (if any are reported), and will be a more polished release, a recommended update.

Please note that this product will be licensed under the WTN.License, which is available for reading here: http://files.wetalknation.net/wtn_license.html (currently being developed)

Please note that this product will be completely free, not lite / professional version.

Please note that this product will only be officially be supported (for free) to all registered members on ONLY the WTN web site (in this thread!).

Side note: The most FAQs are:
- will this work on 3.0, 3.5, 3.6 or 3.7 of vBulletin? The answer is: At this point we don't know. Have yet to find time to test, too early in development.
- will this work on 4.0 or higher of vBulletin? The answer is: At this point we don't know. Have yet to find time to test, or consider supporting 4, too early in development.
- can I help develop this? Yes, we're considering this an open project, but please realize your contributions will become property of WTN and your contributions will be considered as made on our behalf. You will be properly credited.

Okay, so what is this product?

The WTN Report User product is a feature we felt to be missing from vBulletin, but constantly desired by many users over the last 5+ years. We finally had the time to sit down and think outloud and make a proof of concept. After thinking it through and using it live on our site we're so happy with the easy of use and simplicity of the product, that we felt it is worth sharing with our premium members, and later with our registered members and the whole vBulletin community.

It adds the ability to vBulletin 3.8 to report a user (and not just their content) from various places throughout the vBulletin system, starting with their profile.

From the admincp > options > wtn report user settings > you can say where the report is getting posted as a thread, and to report it as which user. It will have a global on/off switch.

At this point we don't use (need) the ability to mail the report to moderators, as it's not about content, but about the user himself (or her). So we deliberately skipped that part. If someone desires this and knows how to code it, we're looking forward to the contribution.

In the next week(s) we will include the download file for our premium members, screenshots for everybody, and visual demonstration video.

DOWNLOAD: (Staff Download)

DOWNLOAD: (Premium Members Download)

WTN.Patch: vBulletin 3.8.5 [Weak Password Hash Decryption]

Floris — Tue, 23 Mar 2010 12:03:07 GMT

This is an untested (due to lack of documentation available) patch for board owners of the forum software vBulletin versions 3.7.6 and up, and vBulletin 3.8.x and up. Note please that I have not taken a look at the 4.0.x patch, so no clue if this works for 4.0.x board owners with now an expired license who can't upgrade.

Disclaimer: As this is untested, it's also not supported, we do what we can. vBulletin will not support this modification, so be smart: Upgrade via the normal path, and/or patch if possible. And for fuck sake: BACKUP your database AND your files.

The wetalk.network grants distribution of these instructions, pending it was asked first, and that a link back to this thread is included for proper credits.

Original source: http://vbfans.com/showthread.php?t=79774
Original announcement from vBulletin.com: http://www.vbulletin.com/forum/showt...and-4.0.2-PL-2

Instructions:

Download: Attachment 3631

There we go :) I hope that helps a few people patch a security issue with their 3.7 / 3.8 board that decide or can't upgrade and still care about security. But if you ask me, this does NOT fix the actual issue. If they can decrypt the hash, they need the salt, but it shouldn't matter if this is 3 or 30 characters long. They would then already have it. They just need a larger rainbow table to check against.

Special note for vBulletin 4 users who haven't patched or upgraded yet: At this point I would hold off, the define I read in the php file is set to 3 still. I suspect "another" fix to follow soon. [edit] Fix has been posted

Attached Images

	patch_line18.png (188.7 KB)
	patch_line830.png (186.1 KB)
	patch_table-user_field-salt.png (365.8 KB)
	patch_edit_field-salt_length.png (211.9 KB)

Attached Files

37_38_security_patch_weak_passwords_hash_decryption.txt (2.7 KB)