Register Members List Search Today's Posts Mark Forums Read

Reply
 
Thread Tools
  #1  
Old 05 Sep 2006, 20:12
TeaTree TeaTree is offline
 
Join Date: May 2005
The top x stats fix hasnt worked

Even though the top x stats was updated yesterday with the aparent fix, users are still managing to re-direct via them-

Why please?

Thanks,

Sam
Reply With Quote
  #2  
Old 05 Sep 2006, 20:52
The Finman's Avatar
The Finman The Finman is offline
 
Join Date: Jun 2006
Cool

It looks like they have been modifying their scripts.

We had one script kiddie try 3 variations of the meta refresh script. I assume the variations are designed to get by patches for the original.

I added my own fix in addition to cyb-advanced stats (basically the same as TopX Stats).

I simply went to vBulletin Options --> Censorship Options --> Censored Words and add these to your list of censored words.


Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

Even though they varied their scripts in order to get by the cyb-advanced stats and TopXStats patches the above fix still stripped out their varibles and they they have all left in a great big script kiddie huff. :laugh:

You know?...actually calling these lamers "script kiddies" is overrating their pathetic abilities.

Anyone using FlashChat needs to upgrade to version 4.6.2 and delete everything in your cmses (chat/inc/cmses/) directory EXCEPT the version of vBulletin you are using (if you are using 3.6 then you want to LEAVE vbulletin36CMS.php Etc). Especially delete anything that says aedating in it's title as it has a serious security flaw in that file.

Also, if you running Apache then you can use an .htaccess file and addi it to the cmses directory.

The .htaccess file should contain the following inside of it


Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

Read more about using .htaccess here http://httpd.apache.org/docs/1.3/mod/mod_access.html

Also, something to think about is that a lot of people have "test" forums on their servers to try out new hacks and upgrades before installing them on their "live" board. Please remember that if you installed Cyb-Advanced Stats, TopXStats or FlashChat on your test board and they are still on there or unpatched then you are still at risk, especialy with FlashChat as they are gaining directory access through holes before 4.6.2.

So to recap...if you have Cyb - Advanced Forumhome Statistics3.6.0 or 3.5.4 please update your version.

If you have Top "X" Stats 3.5.4 or 3.0.0 please update your version

If you have FlashChat please update it to 4.6.2

I also recommend adding this quick but highly effective fix.

Go to vBulletin Options --> Censorship Options --> Censored Words and add these to your list of censored words.


Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.
There are other "fixes" available such as vB 3.6.0 Disallow HTML code in Thread Titles, but the above doesn't require any template edits, and like I said has stopped all variations cold.

If you have been hit with these exploits (and you are able to log into your AdminCP)...go to vBulletin Options ---> Plugin/Hook System--->Enable Plugin/Hook System=NO and use the guides I have listed above.

Hope this helps.

Last edited by The Finman; 05 Sep 2006 at 21:11.
Reply With Quote
  #3  
Old 05 Sep 2006, 21:15
TeaTree TeaTree is offline
 
Join Date: May 2005
Thanks,

It has helped a lot

Originally Posted by The Finman
It looks like they have been modifying their scripts.

We had one script kiddie try 3 variations of the meta refresh script. I assume the variations are designed to get by patches for the original.

I added my own fix in addition to cyb-advanced stats (basically the same as TopX Stats).

I simply went to vBulletin Options --> Censorship Options --> Censored Words and add these to your list of censored words.


Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

Even though they varied their scripts in order to get by the cyb-advanced stats and TopXStats patches the above fix still stripped out their varibles and they they have all left in a great big script kiddie huff. :laugh:

You know?...actually calling these lamers "script kiddies" is overrating their pathetic abilities.

Anyone using FlashChat needs to upgrade to version 4.6.2 and delete everything in your cmses (chat/inc/cmses/) directory EXCEPT the version of vBulletin you are using (if you are using 3.6 then you want to LEAVE vbulletin36CMS.php Etc). Especially delete anything that says aedating in it's title as it has a serious security flaw in that file.

Also, if you running Apache then you can use an .htaccess file and addi it to the cmses directory.

The .htaccess file should contain the following inside of it


Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

Read more about using .htaccess here http://httpd.apache.org/docs/1.3/mod/mod_access.html

Also, something to think about is that a lot of people have "test" forums on their servers to try out new hacks and upgrades before installing them on their "live" board. Please remember that if you installed Cyb-Advanced Stats, TopXStats or FlashChat on your test board and they are still on there or unpatched then you are still at risk, especialy with FlashChat as they are gaining directory access through holes before 4.6.2.

So to recap...if you have Cyb - Advanced Forumhome Statistics3.6.0 or 3.5.4 please update your version.

If you have Top "X" Stats 3.5.4 or 3.0.0 please update your version

If you have FlashChat please update it to 4.6.2

I also recommend adding this quick but highly effective fix.



There are other "fixes" available such as vB 3.6.0 Disallow HTML code in Thread Titles, but the above doesn't require any template edits, and like I said has stopped all variations cold.

If you have been hit with these exploits (and you are able to log into your AdminCP)...go to vBulletin Options ---> Plugin/Hook System--->Enable Plugin/Hook System=NO and use the guides I have listed above.

Hope this helps.
Reply With Quote
  #4  
Old 05 Sep 2006, 21:32
optrex optrex is offline
 
Join Date: Sep 2005
It does seem a bit of a weak fix just relying on censored words. Easy to get round, if they happen to read the vb.org forum !!!

....might be kiddies this time, what happens if you get someone that knows what they are doing next time?
Reply With Quote
  #5  
Old 05 Sep 2006, 21:57
The Finman's Avatar
The Finman The Finman is offline
 
Join Date: Jun 2006
Originally Posted by optrex
It does seem a bit of a weak fix just relying on censored words. Easy to get round, if they happen to read the vb.org forum !!!

....might be kiddies this time, what happens if you get someone that knows what they are doing next time?
All variations of that script require one or more of the words and/or characters I have listed. Those listed should not have any reasonable place on a discussion board unless it is a computer related site that deals with code. I didn't say it was a perfect fix, I said it was an effective fix. If you know of a variation of the meta refresh script that can get past it I would be more than happy to know about it.

Last edited by The Finman; 05 Sep 2006 at 22:01.
Reply With Quote
  #6  
Old 05 Sep 2006, 22:34
optrex optrex is offline
 
Join Date: Sep 2005
Not taking anything away from your fix for that particular script or variant, or indeed your own skills.

But my point is the loophole is still open for others to exploit.
Reply With Quote
  #7  
Old 05 Sep 2006, 23:07
Paul M's Avatar
Paul M Paul M is offline
 
Join Date: Sep 2004
Real name: Paul M
Also, if you can, set "register_globals = Off" in your servers php.ini file - that will stop the Flashchat exploit dead in its tracks (and close an often used/abused security issue in php).
__________________
Former vBulletin.org Staff Member


Cable Forum
Please do not PM me about custom work - I no longer undertake any.
Note: I will not answer support questions via e-mail or PM - please use the relevant thread or forum.
Reply With Quote
  #8  
Old 05 Sep 2006, 23:10
The Finman's Avatar
The Finman The Finman is offline
 
Join Date: Jun 2006
Thumbs up

Originally Posted by Paul M
Also, if you can, set "register_globals = Off" in your servers php.ini file - that will stop the Flashchat exploit dead in its tracks (and close an often used/abused security issue in php).
True dat!

Thanks Paul!
Reply With Quote
Reply



Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


New To Site? Need Help?

All times are GMT. The time now is 01:59.

Layout Options | Width: Wide Color: