New development version fixes security issue

Yves

(Administrator) 2006-05-11, 17:12 #1

User title: UNB developer & webmaster
Member since Jan 2004 · 3855 posts · Location: Erlangen, Germany
Group memberships: Administrators, Members

Show profile ·

Link to this post

Subject: New development version fixes security issue

I was reported a possible remote code exploit in UNB 1.6 Patch 1 and likely also previous versions (not sure about 1.5.x). The attacker needs to have a board account though and register_globals must be on for the bug to be exploited. The only change to fix this bug is the following in unb_lib/abbc.conf.php, around line 635:

...
// Smiley Definitions
// Insert the following two lines:
if (!preg_match('/^([A-Za-z0-9-_]+)$/', $ABBC['Config']['smileset']))
$ABBC['Config']['smileset'] = '';
if ($ABBC['Config']['smileset'])
{
...

As soon as I find the time to finish work on version 1.6.2, there will be a "stable branch" version with all of those things fixed. But you can use the latest development version, too, as it is mainly the same as 1.6.1 Patch 1 and seems to run stable.

Go to the download page.

♪ ...nanananah, all in all we’re just brilliant thieves, nanananah... ♪♬

rgod (Guest) 2006-05-11, 17:21 #2

No profile available.

Link to this post

hi, rgod here, 1.5 branch is also vulnerable, check for design_path var in bb_lib/abbc.css.php, same issue

Yves

(Administrator) 2006-05-11, 17:29 #3

User title: UNB developer & webmaster
Member since Jan 2004 · 3855 posts · Location: Erlangen, Germany
Group memberships: Administrators, Members

Show profile ·

Link to this post

Okay, for version 1.5.3-d (and possibly previous) I suggest the following patch, for bb_lib/abbc.css.php, around line 13:

...
define('UNB_RUNNING', 1);
// Insert the following line:
$design_path = $abbc_cfg['smileset'] = '';
require('abbc.cfg.php');
...

There will be no updated release for UNB 1.5, you'll have to apply that patch yourself or upgrade to 1.6. I guess most 1.5 installations now are heavily modified or their admins just don't care and thus won't read this anyway.

Btw, thanks for the report, rgod. But then not so thanks for the immediate publishing.

♪ ...nanananah, all in all we’re just brilliant thieves, nanananah... ♪♬