[Code Monkey]

This thread will contain posts from the Jelsoft eBulletins & Press Releases forum at vbulletin.com. They will be retrieved using Articlebot's single thread feature as a demonstration of the power of Articlebot and for your security awareness.

[Code Monkey]

vBulletin 3.6 Released – Offers Full Support for Content Sharing



Jelsoft Enterprises Ltd. today announced the release of version 3.6 of vBulletin, the industry-leading message board system. The new version includes extensive support for external content sharing, including RSS syndication and podcasting, as well as many other features designed to enhance the community experience for visitors. See http://www.vbulletin.com for more information.



Berkshire, UK August 3, 2006 - Jelsoft Enterprises Ltd. today released version 3.6 of vBulletin, the industry-leading community message board system. This new version boasts extensive support for sharing of content between web sites, including improved support for RSS syndication and podcasts, along with a raft of new features and improvements designed to enhance the experience for visitors to vBulletin powered bulletin boards.



Kier Darby, Product Manager, sums up the 3.6 concept: "In this era of podcasts and content syndication, vBulletin now includes the tools not only to externally publish articles and messages from your own bulletin board, but also to import and link to content distributed by other sites."



A key element of this exciting new functionality is the RSS Robot, which allows bulletin board administrators to specify RSS feeds from anywhere on the web that will be periodically checked by vBulletin. New items found in those feeds are then posted to the board as new topics. Kier Darby explains the benefits for site owners: "For example, by directing the vBulletin RSS Robot to a news web site that publishes a news feed, the administrator of the bulletin board can have a regular supply of new topics, any of which may stimulate discussion between members."



Podcasting support, allowing automated distribution of audio files to supported applications and digital music players, is now included as standard with vBulletin 3.6. Discussions on the bulletin board can also now be viewed in even more ways, including customized Google or Yahoo! home pages, mobile devices with RSS feed support and convenient desktop applications. A further benefit of the enhanced RSS tools is the ability for groups of vBulletin communities to combine forces and share each other’s content.



Among the multitude of improvements in vBulletin 3.6 is the new ‘User Infraction’ system; allowing administrators and their staff to keep track of troublesome visitors and have the system take action against those whose ‘infraction level’ reaches a defined threshold. Also included is a newly updated "captcha" system to prevent spam robots from posting junk messages to the forums.



For a complete list of new features included with vBulletin 3.6, visit:

http://www.vbulletin.com/go/36features/



To purchase a vBulletin license or evaluate the software using the try-before-you-buy admin demo area, visit http://www.vbulletin.com



For review copies of vBulletin 3.6, high-resolution product images, or any further information, please contact James Limm.



About vBulletin:



First released in 2000, vBulletin is bulletin board software powered by a combination of PHP and MySQL. It is the community solution of choice for thousands of web sites. The built in styles and templates system allows fast implementation, and the comprehensive user features, including avatar support, private messaging and buddy lists, offer an immersive environment to visitors. Our online after-sales support is second to none, available to customers 24/7, with a response rate usually within one hour. Prices start from $85 (£48).

Link To Original Article

[Code Monkey]

JELSOFT E-BULLETIN / SECURITY NOTICE

http://www.vbulletin.com/

August 12th, 2006



* vBulletin 3.6.0 Released

* What's New in 3.6.0?

* Security Notice

* vBulletin 3.5.5 Released

* vBulletin 3.0.15 Released

* vBulletin 2.3.10 Released

* Your License Information

* Contact Us





---------------- VBULLETIN 3.6.0 RELEASED ----------------



The vBulletin team is proud to present vBulletin 3.6.0 'Gold'.



vBulletin 3.6.0 is now our stable, fully supported version, superseding both 3.0.x and 3.5.x. While we will continue to support 3.0.x and 3.5.x with critical bug remedies and security fixes, these lines are no longer in active development.



Note for Upgraders:

If you have customized templates and upgrade to vBulletin 3.6, you WILL need to revert many of them or some areas of your board will not function!



You can read more about vBulletin 3.6.0 and find upgrade instructions on the vBulletin Community Forums here:

http://www.vbulletin.com/go/360



The text of the vBulletin 3.6 press release can be read here:

http://www.vbulletin.com/forum/showthread.php?t=195858



---------------- WHAT'S NEW IN 3.6.0? ----------------



Many customers have been keeping track of the new features that have been added to 3.6 via the vBulletin Community Forums, but for those who have not, this is a brief summary of what's new:



* Multi-Quote

* Linked Quotes

* Mark Forums Read With AJAX

* New Buddy / Ignore List Editor

* Options Backup And Restore

* Private Message Preview In Notification Emails

* Auto-Resize Oversized Image Attachments

* 'Reason For Editing' On Quick Edit

* Unique Unsubscribe Link In Emails

* Plugin Manager Sorted By Product

* Save Search Preferences With AJAX

* Infraction System (Warning system)

* Default Sorting Option Per Forum

* Rate Threads With AJAX

* IP Resolution With AJAX

* Improved Proxy Support In Session Handling

* More AJAX Auto-Completion

* Paid Subscription Permissions

* Show Threads Or Posts From Quick Search Popup

* Phrase Types Identified By Field Name Only

* LastPostID Column In User, Thread And Forum Tables

* Extensive Signature Permissions

* Uploadable Signature Image System

* Improved Image Verification (Captcha)

* Enforced Required Profile Fields

* 'Find Updated Phrases' System

* Pop-Up List Of Attachments In A Thread

* Validation Of Admin Options

* Product Dependencies Support

* Paid Subscription Logging And Statistics

* APC Support For Datastore

* Description Field For Scheduled Tasks

* RSS Poster Robot allows import of RSS feeds into forums

* Latest version check and product URL for products

* Receive private messages from Buddies only option

* Show private forum option per forum

* Give reputation using AJAX

* Error prevention in upgrades

* Option to disable scheduled tasks

* Parsed signature storage for performance boost

* CRON tasks, profile fields, subs, holidays now phrased

* Option to sort forums by thread creation time

* Super moderator permissions

* Welcome private message at registration

* WYSIWYG front-end editing for announcements

* Plugin execution order control

* Flexible username validation

* Private message quota warning system

* Private message admin quota override ability

* Plain-text BBcode parser

* Cache of syndication data (external.php) for improved speed

* Email logging for diagnostics

* Improved performance in datastore failure handling

* Instant view of deleted / ignored posts using AJAX

* Centralized area to view posts awaiting moderation / deleted

* Admin help, scheduled tasks, FAQ now include product support

* CCBill support for paid subscriptions

* Attachment permissions per usergroup

* List posts / threads selected for inline moderation

* Full BCC support in private messages

* Podcasting support

* Atomic flood checking

* Image verification (Captcha) for guest posting

* Thumbnail display options - border / dimensions etc.

* Copy posts using inline moderation

* Announcements show when viewing new posts

* New built-in option types

* Resume paused attachment downloads

* Better webserver logging for POST requests

* Automatically remove thread redirects after set time

* Announcement DataManager

* Persistent D.O.B cookie for COPPA

* Improved master / slave database support

* Improved RSS syndication system



For more information on all these features, take a look at this thread, which contains illustrations and detailed descriptions:

http://www.vbulletin.com/go/36features



-------------------- SECURITY NOTICE ---------------------



Amidst the excitement surrounding the release of 3.6.0, we have not forgotten those customers running previous versions of vBulletin.



The combination of a newly-discovered flaw in Microsoft Internet Explorer and a separate potential cross-site scripting (XSS) flaw in previous versions of vBulletin has prompted us to release updated packages for 2.3.x, 3.0.x and 3.5.x vBulletin branches.



To avoid exposure to these potentially hazardous flaws, we recommend that all vBulletin customers upgrade as soon as possible to either vBulletin 3.6.0 or to the latest version of the branch they are currently running.



Patches are also provided for 2.3.9, 3.0.14 and 3.5.4 as an alternative to upgrading. These patches are available in the vBulletin Members' Area:

http://members.vbulletin.com/patches.php



For more information about how to secure your vBulletin installation, please read the relevant section for your version of vBulletin below.



---------------- VBULLETIN 3.5.5 RELEASED ----------------



In response to the discovery of the security problems noted above, vBulletin 3.5.5 has been released.



vBulletin 3.5.4 can be patched to be secure using the patch available at http://members.vbulletin.com/patches.php but previous versions of 3.5.x will need to be fully upgraded.



We recommend that customers running vBulletin 3.5.x upgrade to 3.6.0 as soon as possible, as this is the currently supported and actively-developed version. If upgrading to 3.6.0 is not possible, upgrade to 3.5.5 or apply the patch as described.



For more details, see the following thread at vBulletin.com:

http://www.vbulletin.com/go/355



---------------- VBULLETIN 3.0.15 RELEASED ---------------



In response to the discovery of the security problems noted above, vBulletin 3.0.15 has been released.



Options to upgrade to 3.0.15 or all the way to 3.6.0 are available. If you are currently using vBulletin version 3.0.14 then a patch is also available should you wish to simply close the security hole rather than fully upgrade.



For more details, see the following thread at vBulletin.com:

http://www.vbulletin.com/go/3015



---------------- VBULLETIN 2.3.10 RELEASED ---------------



In response to the discovery of the security problems noted above, vBulletin 2.3.10 has been released.



vBulletin 2.3.x is now very old and we would recommend that all customers seriously consider upgrading to a more up-to-date and secure version, though customers who wish to simply patch their existing board or upgrade just to the latest 2.3.x version may do so.



For more details, see the following thread at vBulletin.com:

http://www.vbulletin.com/go/2310





---------------- YOUR LICENSE INFORMATION ----------------



You can use this information to log into the members' area

to download vBulletin, ImpEx and other vBulletin-related

support materials:



Customer Number: xxx



If you have misplaced your customer password, you can

request that it be re-sent to your registered email

address using the following form:

http://www.vbulletin.com/go/lostpw



The members' area is located here:

http://members.vbulletin.com/





-------------------- CONTACT US --------------------------



Please do not respond to this email directly. We will not

receive your response. Please use the links below.



Got a vBulletin technical query? Contact support:

http://www.vbulletin.com/go/techsupport



For all other queries, please visit this page:

http://www.vbulletin.com/go/contact



----------------------------------------------------------



This periodic email newsletter is delivered to all current

vBulletin customers, and contains information about new

software versions and Jelsoft.com / vBulletin.com web site

features and content. If you have any questions or

comments about this mailing, please contact us via the

links above.



This email sent to: xxx



Copyright ©2000-2006, Jelsoft Enterprises Limited

Link To Original Article

[Code Monkey]

JELSOFT SECURITY BULLETIN

http://www.vbulletin.com/

November 9th, 2006



* New vBulletin Versions Released

* Your License Information

* Contact Us



-------------- NEW VBULLETIN VERSIONS RELEASED -----------



An undocumented behaviour in all Windows versions of Internet Explorer has rendered vBulletin vulnerable to a potential cross-site scripting flaw (XSS). Therefore, we have decided to put out a preventative security release in order to work-around the Internet Explorer problem before it is exploited.



This potential XSS exploit affects all versions of vBulletin. We have posted instructions on the vBulletin.com announcements forum detailing procedures to upgrade or patch each affected version. Please follow the relevant links below.



Note: While we have supplied patches and updates for all available vBulletin versions, we do recommend that customers not running the 3.6.* series upgrade to 3.6.3, as this is our latest stable release.



Upgrade information and patch for 3.6.* series

http://www.vbulletin.com/go/363



Upgrade information and patch for 3.5.* series

http://www.vbulletin.com/go/356



Upgrade information and patch for 3.0.* series

http://www.vbulletin.com/go/3016



Upgrade information and patch for 2.3.* series

http://www.vbulletin.com/go/2311



---------------- YOUR LICENSE INFORMATION ----------------



You can use this information to log into the members' area to download vBulletin, ImpEx and other vBulletin-related support materials:



Your Customer Number: <snip>



If you have misplaced your customer password, you can request that it be re-sent to your registered email address using the following form:

http://www.vbulletin.com/go/lostpw



The members' area is located here:

http://members.vbulletin.com/





-------------------- CONTACT US --------------------------



Please do not respond to this email directly. We will not receive your response. Please use the links below.



Got a vBulletin technical query? Contact support:

http://www.vbulletin.com/go/techsupport



For all other queries, please visit this page:

http://www.vbulletin.com/go/contact



----------------------------------------------------------



This periodic email newsletter is delivered to all current vBulletin customers, and contains information about new software versions and Jelsoft.com / vBulletin.com web site features and content. If you have any questions or comments about this mailing, please contact us via the links above.



This email sent to: <snip>



Copyright ©2000-2006, Jelsoft Enterprises Limited

Link To Original Article

[Code Monkey]

JELSOFT SECURITY BULLETIN

http://www.vbulletin.com/

1st March 2007



* New vBulletin Versions Released: 3.5.8 and 3.6.5

* Additional Notes For vBulletin 3.6.5

* Your License Information

* Contact Us



---- NEW VBULLETIN VERSIONS RELEASED: 3.5.8 AND 3.6.5 ----



An exploit was recently reported which affects vBulletin versions 3.5.x and 3.6.x. Although the report is inaccurate and the published exploit does not work as claimed unless a highly unlikely set of circumstances exist, it has highlighted a potential security issue in these vBulletin versions.



Therefore, we have decided to release updated versions, these being vBulletin 3.5.8 and 3.6.5. We recommend that all customers running vBulletin 3.5.x or 3.6.x upgrade to the appropriate version or apply the supplied patch as soon as possible.



It is worth noting that in order to exploit the problem highlighted by the report, the attacking user must satisfy the following conditions:



* Must already have moderator privileges



* Must share the same IP address as an existing administrator who is currently logged in to the Admin Control Panel



* Must know the Alt-IP and user agent (exact browser identification) of the administrator OR must know the license number of the site being attacked



Given these requirements, the privilege escalation exploit claimed by the report is almost impossible to achieve.



We have posted instructions on the vBulletin.com announcements forum detailing procedures to upgrade or patch each affected version. Please follow the relevant links below.



Upgrade information and patch for 3.6.* series

http://www.vbulletin.com/go/365



Upgrade information and patch for 3.5.* series

http://www.vbulletin.com/go/358



---------- ADDITIONAL NOTES FOR VBULLETIN 3.6.5 -----------



As well as fixing the security flaw described above, version 3.6.5 also contains fixes for a number of minor bugs affecting Safari cookies, IE7 compatibility, infractions and recent FreeBSD PHP installations. Details of the bugs fixed can be found via the URL listed above.



Please also note that the original intention for vBulletin 3.6.5 had been to include a number of other bug fixes and improvements that have been reported since 3.6.4.



Unfortunately, the necessity of bringing out a version quickly to fix the exploit has meant that many of these fixes have not had sufficient time to be fully tested to the extent that we would like and have therefore been kept back for vBulletin 3.6.6.



We understand that this may be frustrating to our customers, and in order to minimize the inconvenience caused by this update, we have ensured that this vBulletin 3.6.5 release contains no template or phrase changes, which will hopefully make upgrading as painless as possible.

Link To Original Article

[Code Monkey]

18th October 2007



* vBulletin 3.6.8 Patch Level 1 Released

* Patch Levels Explained

* Your License Information

* Contact Us



------- VBULLETIN 3.6.8 Patch Level 1 RELEASED --------------------



Yesterday morning (October 17th 2007) a security issue was reported to the vBulletin team. After investigating the report's claims, it was discovered that the 3.6.8 code does indeed include a flaw that could lead to a cross-site-scripting (XSS) exploit.



Subsequently, a new vBulletin version was prepared and released yesterday afternoon. This version is vBulletin 3.6.8 Patch Level 1 and includes only the fix for the security flaw.



We recommend that all customers running vBulletin 3.6.8 download the new version and upgrade as soon as possible.



The XSS problem can be resolved in either of these ways:



Patch: Download a patch file discussed in this thread and upload them to your web server, overwriting the existing files. The patch is available from the Members' Area patch page or you can find it attached to the 3.6.8 Patch Level 1 announcement thread:

http://www.vbulletin.com/forum/showthread.php?t=245972



Full Package: Alternatively you can download the full package in the vBulletin Members Area and again upload the affected files mentioned in the announcement thread.



------- PATCH LEVELS EXPLAINED --------------------------



In order for the vBulletin team to react even more quickly to the discovery of security flaws, recent versions of vBulletin include a new system that allows the release of special security patch versions, which do nothing except fix the security problem.



This system allows a version number such as 1.0.4 to be altered to 1.0.4 PL1 (PL = Patch Level) so administrators can be sure that they are running the most up-to-date code and are no longer vulnerable to known security problems.



To make use of this system, vBulletin releases that include only security flaws will contain *only* the fixed file(s) plus a new version number file, allowing administrators to simply upload the new files without having to run an upgrade script.



A patch level release contains fixes for only the most critical issues in the previous release. In this case, this means the only changes are to address a security issue.



It is designed to be installed directly over top of your 3.6.8 installation, with no other action. You do not need to run any upgrade scripts.



-------------------- CONTACT US --------------------------



Please do not respond to this email directly. We will not receive your response. Please use the links below.



Got a vBulletin technical query? Contact support:

http://www.vbulletin.com/go/techsupport



For all other queries, please visit this page:

http://www.vbulletin.com/go/contact

Link To Original Article