vBulletin 5.6.1 Security Patch Level 1

[bendiesel]

Installing the Patch

1. Download the appropriate files for your version of vBulletin.
2. Upload all files found within the zip file. Make sure to overwrite the existing files on your server.

excuse my question, but should i do it like an upgrade ?

[Mark.B]

No. You just upload the patch files.

More information here:
https://forum.vbulletin.com/forum/vb...security-patch

[bendiesel]

i was just running the upgrade process, because i found that zip file is like a new version file (there is upload and do_not_upload folders), so i couldn't understand what does it mean :

Upload all files found within the zip file. Make sure to overwrite the existing files on your server.

[Mr Peabody]

i was just running the upgrade process, because i found that zip file is like a new version file (there is upload and do_not_upload folders), so i couldn't understand what does it mean :

The Security Patches are separate. Look on the left hand side in your Members Area for Patches/Security Patches

[Wayne Luke]

You can upload all the files in the 5.6.1 Patch Level 1 full download. You do not need to run upgrade.php. That is only needed when there are database changes.

[LynneC]

My site currently is at patch 5.5.4 Level 2. Can I just patch with the 5.5.6 Patch?

[In Omnibus]

My site currently is at patch 5.5.4 Level 2. Can I just patch with the 5.6.1 Patch or do I need to do the upgrade thing?

You need to upgrade. The patch only works without the upgrade script if you're already running the same version as the patch, 5.6.1.

[LynneC]

Can I patch with the 5.5.6 patch?

[Wayne Luke]

Can I patch with the 5.5.6 patch?

No you cannot. You need to upgrade. The patch will work for the version it is created for and only that version.

[LynneC]

Can I upgrade directly to 5.6.1 from 5.5.4?

[Mark.B]

Can I upgrade directly to 5.6.1 from 5.5.4?

Yes. Download the FULL 5.6.1 package from the members area (NOT just the separate patch files). Then unzip and unload this, and run the upgrade script.
Note that you should always back up database and files before running an upgrade.

[Mark.B]

Have installed the patch but can't find a "readme" or similar to know what vulnerability it fixes or how to tell if we have already been "got".
Is there a description of the problem somewhere?

This sort of information is not made public because doing so advertises how to exploit unpatched sites.

[Wayne Luke]

We provide the information that is authorized by our parent company's legal department. We are not allowed to disclose anything else.

With this security exploit, we do not believe it was in the wild before the patch was released.

[bendiesel]

sorry to insist to be 100 % sure:

before getting your response i did the following:
- have 5.6.1
- download the zip file 5.6.1 patch level 1
- unzip, we could found upload and do_not_upload folders
- upload only the upload folder, and running the upgrade script
- the site is ok and it show 5.6.1 patch level 1

1- did i something wrong ?
2- we shouldn't upload the do_not_upload folders, is that right ?

[Mark.B]

sorry to insist to be 100 % sure:

before getting your response i did the following:
- have 5.6.1
- download the zip file 5.6.1 patch level 1
- unzip, we could found upload and do_not_upload folders
- upload only the upload folder, and running the upgrade script
- the site is ok and it show 5.6.1 patch level 1

1- did i something wrong ?
2- we shouldn't upload the do_not_upload folders, is that right ?

That will do the trick, though if you were already on 5.6.1 you only needed the patch files, but what you have done will work

You upload the contents of the upload folder (not the folder itself) and you do not upload the 'do_not_upload' folder.