vBulletin 3.7.2 PL2 and 3.6.10 PL4 Released

**Cerberus** · 08-18-2008, 05:20 AM

vBulletin 3.7.2 PL2 / vBulletin 3.6.10 PL4

An XSS flaw related to JavaScript escaping has been identified. This could allow an attacker to carry out an action as a user or obtain access to a user's account. To resolve this issue, it is necessary to release patch level versions of vBulletin 3.7.2 and 3.6.10.

This flaw was discovered by Federico Muttis.

The upgrade process is the same as previous patch level releases - simply download the patch from the Members Area, extract the files and upload to your webserver, overwriting the existing files. There is no upgrade script required.

As with all security-based releases, we recommend that all customers upgrade as soon as possible in order to prevent any potential damage resulting from the flaw being exploited.

vBulletin 3.7.3 and 3.6.11 to be Released Next Week

In line with our new scheduled maintenance release policy, a new release for 3.6 and 3.7 will be made on Tuesday, August 26th.

These releases will contain bug fixes, but will also address a situation related to users that use their username as their password. In 3.6.11 and 3.7.3, this will be completely disallowed. Users affected by this will be forced to change their password on their first login. Additionally, a tool will be provided to email affected users with a new password. Please be aware of these potential compatibility changes when upgrading.

This release will be mentioned in the security bulletin sent out to customers today, but we will not send a further notification next week when 3.7.3 and 3.6.11 are released. Watch your Admin CP News, or the latest version check in the Admin CP to see when the new version is available. Alternatively, keep an eye on this forum for the 3.7.3 and 3.6.11 announcements.

Upgrading from 3.7.2, 3.6.10 or their patch level versions

If you are already running 3.7.2, 3.6.10 or their patch level versions, the process you will be required to follow to make your board immune to the XSS problem is very simple.

There is no need to run an upgrade script if you are already running 3.7.2, 3.6.10 or their patch level versions.

Visit the Patches section of the vBulletin Members' Area and download either the patch for 3.7.2, or the patch for 3.6.10, according to the version you are currently running, then extract the files from the archive you downloaded, then upload the files to your board via FTP etc., overwriting the existing files. This will update your version to the PL1 or PL3 release respectively.

The 3.7.2 PL2 patch file includes the PL1 fix.
The 3.6.10 PL4 patch file also includes the PL1, PL2, and PL3 fixes.

Upgrading from Versions Earlier than 3.7.2 or 3.6.10

If you are not already running 3.7.2 or 3.6.10, you should download the most latest version from the Members' Area and perform an upgrade as normal.

Full instructions for upgrading vBulletin are available here.

Download vBulletin 3.7.2 PL2 or 3.6.10 PL4

As usual, both versions released today are available for all customers with valid, active licenses to download from the vBulletin Members' Area.

vBulletin Members Area

**ArnyVee** · 08-18-2008, 06:05 AM

Is it that huge of a security issue to put out a patch when there's another update coming out in a week?

**glennybee** · 08-18-2008, 07:18 AM

That's what I was thinking, I think I'll just wait for the 3.7.3 revision.

**Greek76** · 08-18-2008, 11:30 AM

Looks like going to have to be doing templated edits all over again lol next week.

**snakeair** · 08-18-2008, 01:03 PM

Strange, i updated today and now next week will do the same thing. Couldn't they just put this patch in with the next one. What could happen in a week anyway's?

I hope there are no template changes in the next release coming. That's what i hate the most, if template changes need to be made. lol

**Caddyman** · 08-18-2008, 05:40 PM

there usually aren't too many template changes, i wouldnt worry about it, if you logged into my ACP you would see a glaring 23 templates that need edited....lol

no biggie.

**ArnyVee** · 08-18-2008, 06:47 PM

I have 16 that need editing too. But, I haven't run into any issues, so I guess I'm okay.

**Michael Biddle** · 08-18-2008, 07:13 PM

I do not know why people are complaining about this upgrade...it is just 4 new files to upload and your fixed...Be secure and patch, or leave a hole, the choice is yours. They are not forcing you to update. And their are no template updates in the patch.

**Cerberus** · 08-19-2008, 03:28 AM

Yeah it takes all of a minute LOL

**Soliloquy** · 08-21-2008, 08:35 AM

I'm glad there are no template editss this time because I'm not even done with the last round yet! But still patching all my vBulletin sites is yet another chore to add to the list...

**Caddyman** · 08-21-2008, 09:22 AM

i usually dont upgrade till there is a release that includes cool features, if it is a bad bad security flaw i will but if not ill skip it.

**snakeair** · 08-21-2008, 01:21 PM

Does anyone know what's instore for the next big vBulletin release? I do like the nice features we have now in 3.7

Plus, people are coming up with awesome codes at vbulletin.org

**Michael Biddle** · 08-21-2008, 05:10 PM

Well the biggest thing that I think is in store for the 3.7.3 is you cannot have your password = your username. Other then that, just the trivial fixes I believe. I also expect to see the blog 2.0 beta to be out relatively soon once they release the 3.7.3 as they said it is required for the new version.

**Soliloquy** · 08-22-2008, 01:26 PM

Snakeair, they said something about improved user albums and social networking features, I think...

**snakeair** · 08-22-2008, 02:46 PM

That's good cause i'm still not sure what to do with those features right now. Perhaps a better idea will come to mind as the features get added.

**Caddyman** · 08-23-2008, 07:27 AM

yeah the user albums will have more control features, you will be able to move pics from one album to anothers and such (my members complained about that almost immediately.)

**Soliloquy** · 08-23-2008, 06:34 PM

You'd think they'd build that in with the release of user albums, but I guess not...

**Caddyman** · 08-23-2008, 06:47 PM

yeaht eh only way now is to delete the pic from the album and reupload it to the album you want it in which is kinda of a PITA