Jump to content


Photo
- - - - -

IP.Board Security Enhancements


This topic has been archived. This means that you cannot reply to this topic.
No replies to this topic

#1 IPS News

IPS News

    Public Relations

  • IPS Staff
  • 1,060 posts

Posted 12 September 2007 - 10:02 AM

IP.Board Security Enhancements

We are releasing three minor security updates to address issues recently reported regarding areas of IP.Board 2.3.1. These security issues are rather low priority and require specific sets of circumstances to be utilized. Even then the impact is minimal due to other security features in the software.


Issue 1 (Reported by http://www.turkish-media.com/forum/ )

If you use a character set other than iso-8859-1 or utf-8, it is possible to submit javascript to your user profile fields. The potential damage is mitigated by the use of httpOnly cookies in IP.Board. Please note that IP.Board ships with iso-8859-1 set by default. Therefore, unless you have specifically changed the character set in the Admin CP your installation is not impacted by this issue.

Issue 2 (Reported by http://www.criticalsecurity.net/ )

A user is able to upload a non-image file if the file is given an image name in a specific format. The security implications are very low because IP.Board automatically resets the file to a .txt file and treats it as such, however this could result in broken photo or avatar images being displayed, and script files with a .txt extension saved in your uploads directory. Again the potential damage is mitigated by the use of httpOnly cookies in IP.Board thereby disallowing javascript access to cookies.

Issue 3 (Reported by http://communityseo.com/forums/ )

If you have subscription packages enabled on your site using the subscriptions manager included with IP.Board which promote a paying user to a new user group, it is possible to recraft a payment form to set the member's ID to a different member. The issue would require that an actual valid payment is made and no unauthorized access could be gained, however a specially crafted form could result in all administrators/moderators of a site being demoted to a subscriber group, for example. The reverse, a user being promoted to admin, is not possible in this issue.


Patching Your IP.Board

The IP.Board 2.3.1 download in the client area has already been updated with the required changes. If you download IP.Board after the date of this announcement your installation will be up to date.

Changed Files
Download the zip file below which includes only the changed files for this update. Simply upload and overwrite the old files.

Attached File  9.12.2007.zip   23.55KB   3051 downloads

Manual Instructions
The following file contains manual patch instructions for those who want to edit php files by hand.

Attached File  Instructions.txt   10.72KB   3552 downloads