[Forum] new XSS vulnerability [4.0.2 PL 1] we are affected?

[tonetu]

Hi there,
I heard that some one discovered a new way to hack 4.0.2 PL 1 by XSS and they discovered it yesterday and still vb.com didn't tell us what we have to do?

is this right they can hack our forum by XSS? and we are affected and ready to get hacked?

[Floris]

yes, all 4.0.2 pl1 are affected.

[icarusforde]

*sighs*

Here we go again.

*Waits for Patch Level Two*

[sd2310]

*sighs*

Here we go again.

*Waits for Patch Level Two*

There should be only a few lines of code to edit, why is it taking so long ?

[icarusforde]

Because it's not just a few lines of code to edit.

[sd2310]

Because it's not just a few lines of code to edit.

Okay, I thought it must be quite easy

[icarusforde]

Not really. It's easier for hackers to get in than to keep hackers out... That being said, it should be harder for them to get in when it comes down to it in the first place.

[Paul M]

Quick [temp] fix ;

Search the templates for {vb:raw query} replace with {vb:var query}

There are about 10 of them.

[setishock]

Back up your databases and current files and folders. If you get smacked you can over write the affected files with your backups. It's a good idea to do that anyway.
Hopefully they get a patch out soon.

[Gumble]

Quick [temp] fix ;

Search the templates for {vb:raw query} replace with {vb:var query}

There are about 10 of them.

Thanks Paul

[CThiessen]

Hi,
could something equal has any effect on vB 3.8.x or is that special in vB4.

Greetings
Christian

[sd2310]

Hi,
could something equal has any effect on vB 3.8.x or is that special in vB4.

Greetings
Christian

Special for vB4.

[sd2310]

Quick [temp] fix ;

Search the templates for {vb:raw query} replace with {vb:var query}

There are about 10 of them.

Thanks

[lim (x³-7x²) = ∞]

date [2010-03-19]

why it take them so long to react? 2 days and still not fixed

previous xss was fixed after more then 1 week (first report 2010-02-15, second report 2010-02-20, fixed on 2010-02-23)

[sd2310]

why it take them so long to react? 2 days and still not fixed

Maybe because:

Because it's not just a few lines of code to edit.