Phpbb2

Trystam

Power Member
Desde o dia 15 de Novembro que se tem vindo a registar ataques contra sites com foruns baseados em BB´s PHPBB2.
O Motivo é um "Bug" no código do ficheiro viewtopic.php que permite um ataque de remote code execution e que tem vitimado alguns sites pelo mundo fora.

Versões Afectadas:

Versão 2.0.10 e anteriores

Versão Patch:

Versão 2.0.11 : Já disponível no site do PHPBB para Download
Nota: Versão compilada em regime de emergência com base na necessidade do patch , que pode conter alguns bugs que deverão ser corrigidos nos proximos tempos.

Aparte desta solução de fazer o upgrade do PHPBB2 pode ser feita uma alteração no código do ficheiro viewtopic.php como é mostrado abaixo:

Procurar no ficheiro viewtopic.php a seguinte "String":
//
// Was a highlight request part of the URI?
//
$highlight_match = $highlight = '';
if (isset($HTTP_GET_VARS['highlight']))
{
// Split words and phrases
$words = explode(' ', trim(htmlspecialchars(urldecode($HTTP_GET_VARS['highlight']))));

for($i = 0; $i < sizeof($words); $i++)
{

e substituir por :

//
// Was a highlight request part of the URI?
//
$highlight_match = $highlight = '';
if (isset($HTTP_GET_VARS['highlight']))
{
// Split words and phrases
$words = explode(' ', trim(htmlspecialchars($HTTP_GET_VARS['highlight'])));

for($i = 0; $i < sizeof($words); $i++)
{

Espero que ainda consigamos ir a tempo de parar alguns dos sites de irem abaixo.

Alguma dúvida ou questão que achem pertinente fica o post aberto.

Abraço
 
Coloquei esta thread em sticky porque isto é informação vital para evitar problemas como o ocorrido na *****, e que está de momento a acontecer na *****.
 
Trystam disse:
Procurar no ficheiro viewtopic.php a seguinte "String":
//
// Was a highlight request part of the URI?
//
$highlight_match = $highlight = '';
if (isset($HTTP_GET_VARS['highlight']))
{
// Split words and phrases
$words = explode(' ', trim(htmlspecialchars(urldecode($HTTP_GET_VARS['highlight']))));

for($i = 0; $i < sizeof($words); $i++)
{

e substituir por :

//
// Was a highlight request part of the URI?
//
$highlight_match = $highlight = '';
if (isset($HTTP_GET_VARS['highlight']))
{
// Split words and phrases
$words = explode(' ', trim(htmlspecialchars($HTTP_GET_VARS['highlight'])));

for($i = 0; $i < sizeof($words); $i++)
{

Tentei utilizar este código e o forum ficou buggado... :( isso resulta mesmo?
 
Eu fiz as alterações em vez de fazer upgrade e fui hackeado...
hoje.

Será que os animais costumam mexer na base de dados ou é só no fixheiro do índice?

Tkzzz
 
Acabei de fazer ao fórum da Magia on Tour, que apesar de ser muito pouco utilizado, poderia ser alvo de alguma brincadeira. :)

Eis como fiz.

  • Puxei o patch (dado que estava a fazer upgrade da 2.06 para esta recente (2.0.11)
  • Depois de extrair o zip, li ATENTAMENTE o Install.html e o Readme.html que estão na dir /docs do zip que extrairam.
  • Backup integral do fórum que está instalado no servidor.
  • Segui as instruções, fiz o uplaod, corri o upgrade_to_2011.php e tudo correu bem.
  • Fui à página de admin e confirmei que estava tudo OK, et voilá.
  • Ah, inscrevi-me para receber os regular updates ao PHPBB. :)

Boa sorte!
 
Eu estou com a versão 2.0.10 e keria mudar para a 2.0.11 para resolver esse problema!!

Então é assim:
Fiz o que o super disse, já fiz buckup e tudo e ja sakei o patch....
Tive a ler os files que ele aconselha e deparei-me com o seguinte problema:

Falam lá em:
patch -cl -d [PHPBB DIRECTORY] -p1 < [PATCH NAME]

Ora, o k eu tenho k fazer é:

1º copiar o file phpBB-2.0.10_to_2.0.11.patch para a pasta onde tá o forum
2º patch -cl -d htto://.../forum -p1 < phpBB-2.0.10_to_2.0.11.patch ?!?!?!?!?

Se sim, onde é k eu executo esse comando?
 
Done........

Ora como fiz (para os interessados):

  1. Saquei este patch
  2. Depois de extrair, retirei o k me interessava (no meu caso):
    • este file: phpBB-2.0.10_to_2.0.11.patch
    • directoria: install
  3. Coloquei o file phpBB-2.0.10_to_2.0.11.patch na directoria http://.../forum
  4. Coloquei a pasta install na mesma directoria (ficando assim http://.../forum/install)
  5. Abri o browser com o endereço: http://.../forum/install/upgrade_to_2011.php
  6. Depois de terminado, apagar a directoria install da localização http://.../forum/install
  7. Aceder ao forum e verificar que a versão já é 2.0.11

Foi assim que fiz e até agora não tive problemas!! Vamos lá ver se fica tudo resolvido!!!

Thks SUp3rFM!!
 
Última edição:
Take a look:

Did that cause you to miss a heart beat? Good, it did its job then. So what's this all about? Well the next release will not be version 2.2. Instead it's taking the codename "Olympus" and will, upon release have the version number 3.0.0. Each new release, at least each new minor revision update will take a codename.

Why are we renumbering? Well I'm sure some will say it's a ploy to try and "compete" with other boards. Many of which have upped their version numbers to stay "competitive". However this is not the core reason for our decision.

We use the kernel numbering scheme. The methodology of that requires the major number to change when backward compatibility is broken. That's the case with the new release. Not one style will work "as is", practically no Mods will function. Even the language file contents and structure are completely different. This warrants, in our opinion cause to increment the major number. NB: An upgrade script will obviously be provided (and is currently in beta test) enabling you to upgrade your existing 2.x database to 3.0.0.

It also reduces concern amongst our support teams coping with people noting issues with "phpBB2". A major version increment differentiates clearly between 2.x and this new release.

So to reiterate very clearly, the next major release of phpBB, now 3.0.0 "Olympus" is still en-route. We are very unlikely to hit the initial window for the beta release. I would anticipate instead a late-Feb/early-March release. The final feature list is complete and work progresses on implementing as much of this as possible. Such items include (but are not limited to):

Warning system
Completion of report system
Completion of "new" module system and updating of ACP/UCP/MCP modules
Styling
Permissions

and a number of other minor and more significant items. Of these the ACP poses the biggest component.

I can confirm that "Olympus" will feature an entirely new style produced by Tom "subblue" Bebbard, designer of subSilver. This new style will not ship with the beta, it will not ship with the release candidates. It will only ship with 3.x. This is to prevent the same situation occuring with the new style as happened with 2.x ... designers copying the style for other boards, diluting the "wow factor" upon phpBB 2's release. Such boards can go find themselves a top flight designer if they so wish. I will however say I think you'll like the new style

We are also considering continuing development of the 2.x line (codename yet to be decided ). We understand that some people will not upgrade to 3.x, they like the reduced complexity and lower feature count of 2.x ... it does "what they want" so to speak. The 2.x line would see us continue bug fixing along with the introduction, where appropriate, of elements coded for the 3.x line. Such elements could see speed and security enhancements being introduced. While retaining compatibility with the majority of Mods and styles. I say again this is not a "for sure" but it is a probability.
 
Nova versão 2.0.12

Hi everyone,

phpBB Group announces the release of phpBB 2.0.12. This release
addresses a couple of potential exploits and fixes a number of issues
involving path disclosures, etc. It also introduces a new ACP based
version check (language package maintainers please note the
additional localisation required for this). For further information
please see our announcements forum at www.phpbb.com:

http://www.phpbb.com/phpBB/viewtopic.php?t=265423

As with all new releases we urge you to upgrade as soon as possible.
You can of course find this download available on our website at:

http://www.phpbb.com/downloads.php

As per usual three packages are available to simplify your upgrade.
Upgrade information using the mod template should be available
shortly (for those who prefer this method).

----

To unsubscribe from this list visit http://www.phpbb.com/lists/?p=unsubscribe&uid=8b580f949b90882e4c472ba3809cf790




--
Powered by PHPlist, www.phplist.com --
 
Acabei de instalar a 2.0.13 que traz bugfixes em relação a uns quantos buracos criados pela 2.0.12. Digamos que mais uma vez, através de uns pequenos passos, podemos tomar conta do fórum por completo...

phpBB Group announces the release of phpBB 2.0.13, the "Beware of the furries" edition. This release addresses two recent security exploits, one of them critical. They were reported a few days after .12 was released and no one is more annoyed than us, having to release a new version in such a short period of time.
Fortunately both fixes are easy and in each case just one line needs to be edited.

http://www.phpbb.com/downloads.php

Façam o upgrade... ou sujeitam-se.
 
Mas agora temos que andar todos os meses a fazer actualizações? É que tenho o meu forum cheio de modificações então não chega apenas mudar os ficheiros :( bah
 
Caro OpenMind, tudo o que tens a fazer é executar os updates manualmente, visto que, pelo menos estes últimos, são bem simples. Então este último faz-se, sem exagero, em dois minutos. Também eu tenho um phpBB com vários MOD's, por isso tenho que fazer os updates à unha.
 
Subject: phpBB 2.0.14 released
Headers: Show All Headers | Show Mailing List Information

Hi everyone,

phpBB Group announces the release of phpBB 2.0.14, the "We know we are (not) furry" edition. This release addresses some bugfixes as well as fixing some minor non-critical security issues. All issues not reported to us before being released are not credited to the founder, as usual.

As with all new releases we urge you to update as soon as possible. You can of course find this download available on our downloads page (http://www.phpbb.com/downloads.php). As per usual three packages are available to simplify your update.

Actualizem!
 
Back
Topo