IP.Board Security Enhancements

We are releasing three minor security updates to address issues recently reported regarding areas of IP.Board 2.3.1. These security issues are rather low priority and require specific sets of circumstances to be utilized. Even then the impact is minimal due to other security features in the software.


Issue 1 (Reported by Forumlar (Tartýþma ve Paylaþýmlarýn Merkezi - Türkçe Forum - Turkish Forum / Board / Blog) )

If you use a character set other than iso-8859-1 or utf-8, it is possible to submit javascript to your user profile fields. The potential damage is mitigated by the use of httpOnly cookies in IP.Board. Please note that IP.Board ships with iso-8859-1 set by default. Therefore, unless you have specifically changed the character set in the Admin CP your installation is not impacted by this issue.

Issue 2 (Reported by Critical Security.NET (Powered by Invision Power Board) )

A user is able to upload a non-image file if the file is given an image name in a specific format. The security implications are very low because IP.Board automatically resets the file to a .txt file and treats it as such, however this could result in broken photo or avatar images being displayed, and script files with a .txt extension saved in your uploads directory. Again the potential damage is mitigated by the use of httpOnly cookies in IP.Board thereby disallowing javascript access to cookies.

Issue 3 (Reported by CommunitySEO (Powered by Invision Power Board) )

If you have subscription packages enabled on your site using the subscriptions manager included with IP.Board which promote a paying user to a new user group, it is possible to recraft a payment form to set the member's ID to a different member. The issue would require that an actual valid payment is made and no unauthorized access could be gained, however a specially crafted form could result in all administrators/moderators of a site being demoted to a subscriber group, for example. The reverse, a user being promoted to admin, is not possible in this issue.


Patching Your IP.Board

The IP.Board 2.3.1 download in the client area has already been updated with the required changes. If you download IP.Board after the date of this announcement your installation will be up to date.

Changed Files
Download the zip file below which includes only the changed files for this update. Simply upload and overwrite the old files.

9.12.2007.zip ( 23.55K ) Number of downloads: 1636


Manual Instructions
The following file contains manual patch instructions for those who want to edit php files by hand.

More...