-
PostNuke Security Advisory PNSA 2005-2
(News)
-
VULNERABILTIES
- various missing input validations within /modules/Xanthia/ [1]
- missing input validation within /modules/Messages/readpmsg.php [1]
- possible path disclosure within /user.php [2]
- possible path disclosure within /modules/News/article.php [2]
- possible remote code injection within /includes/pnMod.php [3]
- possible cross-site-scripting in /index.php
SOLUTION
It is recommended that all admins do an immediate upgrade of their sites to v0.750b by applying the latest security fix package available from the locations listed below. Since the Xanthia-module will be updated the site's theme needs to be set to ExtraLite (or any other non-Xanthia theme) prior to applying the update. After uploading the fixpackage the modules list needs to be regenerated and the Xanthia module upgraded within Administration-Modules.
Please note the main package has been updated to include this advisory so there is no need to apply this patch if you have downloaded PostNuke after the date of this announcement.
The /index.php and /includes/pnMod.php fixes are also available for the current .760rc4a Release Candidate within the changed files only package, the main package has also been updated with the fixes.
UPDATED PACKAGES
1. PostNuke 0.750 (tar.gz format)
http://news.postnuke.com/Downloads-index-req-viewdownloaddetails-lid-411.html
SHA1: 60ef6f7c93cfa638fc7d089e078db0eaa59f95b4
MD5: c40ebc31cfa3ada351dbe63f4e9a6255
Size: 2407332 Bytes
2. PostNuke 0.750 (zip format)
http://news.postnuke.com/Downloads-index-req-viewdownloaddetails-lid-410.html
SHA1: 50edfbb3c12bed0b80413d421d1a90ff28ed0c22
MD5: 26dc0202c776f7463008c54ce8cf89b9
Size: 3501230 Bytes
3. Security Fix (changed files only) for PostNuke 0.750 (tar.gz format)
http://news.postnuke.com/Downloads-index-req-viewdownloaddetails-lid-471.html
SHA1: 6e76d92124c833618d02dfdb87d699374120967d
MD5: a007e741be11389a986b1d8928a6c0e5
Size: 160550 Bytes
4. Security Fix (changed files only) for PostNuke 0.750 (.zip format)
http://news.postnuke.com/Downloads-index-req-viewdownloaddetails-lid-472.html
SHA1: d504155418ab6d07491b3a6c0d18834fe20bbefd
MD5: e472c9917e2ff237b354bdc87838c504
Size: 247175 Bytes
CREDITS
The [1] exploits have been originally found by Maksymilian Arciemowicz from http://www.securityreason.com/ and were reported via security contact. The path disclosure issues [2] were found by 'Diabolic Crac' and reported to various trackers. The remote code injection [3] was reported by Mohamad Saleh Raub from http://www.scan-associates.net to the security contact.
Andreas Krapohl
PostNuke Development Team
Generated on May 20, 2005.
-
PostNuke 0.750 Gold Hebrew Translation
(News)
-
Work is in progress for a valid, proper translation for PostNuke in the Hebrew language (he_IL, ISR, heb)
The final product would be offered, for now, as a complete package (modified PostNuke, changes are written onto original english installation).
This is mostly because doing LTR to RTL is most intrusive and doesn't end at just translating all the lang files.
Later on, and as need arises, I would attempt either writing an updater script that would search new versions and replace text as needed, or look for an option to integrate the language as an addon (like all other languages), but the whole idea seems very unlikely, because of the waste of time (doing this 1 man crew thing).
If I would have more support and help, there would be a stable and reliable support for versions newer than 0.750 gold.
Any one who wants to contact me for this project should do so at:
lordskp [at] gmx [dot] net
Requirements:
Basic PHP knowledge (I won't rule out people who wants to learn, though)
Hebrew-English, fluent.
Common sense.
If you still hesitate, I hereby announce that Postnuke is the most assuring project for Hebrew CMS. I've spent about 10 hours of my free time, to check on other leading CMSs, and to see if they like Hebrew -- they didn't!.
And i won't even talk about hebrew for PHPNuke!!.
Generated on March 16, 2005.
-
PostNuke Security Advisory PNSA 2005-1
(News)
-
VULNERABILTIES
- missing input validation within /modules/Modules/pnadmin.php
- missing input validation within /includes/blocks/past.php
- missing output validation within /modules/Downloads/admin.php
- missing input validation within /modules/Downloads/dl-util.php
- missing input validation within /modules/Downloads/dl-search.php
- possible path disclosure within /modules/News/index.php
SOLUTION
It is recommended that all admins do an immediate upgrade of their sites to v0.750 then apply the latest security fix package available from the locations listed below.
Please note the main package has been updated to include this advisory so there is no need to apply this patch if you have downloaded PostNuke after the date of this announcement.
UPDATED PACKAGES
1. PostNuke 0.750 (tar.gz format)
http://news.postnuke.com/Downloads-index-req-viewdownloaddetails-lid-411.html
SIZE: 2410936 Bytes
MD5 checksum: dcb276fa0aae4e22764eb22fd66ccd09
SHA1 checksum: bc8c5ccde62312956f72a144e67efbf65bf82349
2. PostNuke 0.750 (zip format)
http://news.postnuke.com/Downloads-index-req-viewdownloaddetails-lid-410.html
SIZE: 3408707 Bytes
MD5 checksum: f49e17d4040892634c53b9fb5afe650c
SHA1 checksum: 82590102de8b0171993eaf94cc73006ad84ae752
3. Security Fix (changed files only) for PostNuke 0.750 (tar.gz format)
http://news.postnuke.com/Downloads-index-req-viewdownloaddetails-lid-457.html
SIZE: 26990 Bytes
MD5 checksum: 2e654367bda64f8e9944273991997068
SHA1 checksum: fde99e26357003a8fd36aa7fde0da2859dc2c0b5
4. Security Fix (changed files only) for PostNuke 0.750 (.zip format)
http://news.postnuke.com/Downloads-index-req-viewdownloaddetails-lid-458.html
SIZE: 32088 Bytes
MD5 checksum: e8b118732f19aa55d80550f6fe4d0caa
SHA1 checksum: f018e4f1d5339dce4b6a8419ac98a555c89945a2
NEW RELEASES
1. PostNuke 0.760RC3 (tar.gz format)
http://news.postnuke.com/Downloads-index-req-viewdownloaddetails-lid-459.html
SIZE: 2936077 Bytes
MD5 checksum: FE0A655663073F9F68F878359CD459B3
SHA1 checksum: 7DCE900CE0B4A4940AB18143FE2B82FB526DBC89
2. PostNuke 0.760RC3 (zip format)
http://news.postnuke.com/Downloads-index-req-viewdownloaddetails-lid-460.html
SIZE: 4265380 Bytes
MD5 checksum: c2cce796bbf803c7018fa2f4b2891c9f
SHA1 checksum: cb5dc8953a562bcf07bca392dcbe18009942e32c
ADDITIONAL INSTRUCTIONS
Place the files contained in this patch into the appropriate PostNuke directory that replaces the current files because by doing this you are applying the security fix to the system fix and this is what is meant by "patching" your system.
If you would like to receive security updates in the future, please subscribe to the PostNuke security list.
SPECIAL NOTE FOR .760RC3
PostNuke .760RC3 is not recommended for production sites. If performing an upgrade to .760 please review manual.txt carefully. Many of the core system modules are upgraded in this release so the process needs to be followed exactly.
CREDITS
The exploits have been originally found by Maksymilian Arciemowicz from http://www.securityreason.com/ and were reported via security contact.
Andreas Krapohl , PostNuke Development Team
February 28th, 2005
Generated on February 28, 2005.
-
Simplified Chinese 0.750 Translation Finished
(News)
-
Generated on January 17, 2005.
-
PhpNuke2PostNuke : Your bridge to the PN World
(News)
-
provided there. This script works ONLY for MySQL 3.x schema. For other dbms (PostgreSQL, MsSQL, MySQL 4.x) you need modify the script.
++ UPGRADE SUMMARY ++
PhpNuke 7.0, 7.1, 7.2, 7.3, 7.4 -> PostNuke 0.726
PhpNuke phpBB2 Forums port 2.0.5 -> PNphpBB2 1.2d
PhpNuke Encyclopedia -> pnEncyclopedia 0.2.0
PhpNuke Event Calendar -> PostCalendar 4.0.1
A new version for 0.750 is coming soon. I'm looking for make this a project at noc. Please help me on this topic.
Download link
Support forum
Generated on September 14, 2004.
-
Final Release of 0.750 coming up !
(News)
-
Generated on August 29, 2004.
-
PostNuke 0.750 Gold Release Candidate 4
(News)
-
Generated on August 15, 2004.
-
PostNuke 0.750 Gold Release Candidate 3 and XTE 5
(News)
-
7) Setting for controlling loading of legacy code (also XTE5); note: some modules
may have a problem with this setting being off - results largely untested.
8) Adodb was updated to 4.22 so PostNuke should work in php5 environments
9) Queryutil.php (some kind of pre-adodb database abstraction) has been deprecated
- all corresponding sql-statements have been rewritten
10) Bugs that have been reported are fixed.
11) The credit for the idn-class goes to Matthias Sommerfeld
12) Improved section 508 / WCAG / BITV compliance for the frontend (mostly label,
tabindex etc).
13) Theme Pack - Addition of homepage templates with center blocks only in this
template, so centerblocks are only on frontpage if wanted.
You can find further information about the PostNuke 0.750 Gold release
here.
Please report any bugs using the bug tracker found on the "Development"
block on every postnuke.com page.
Downloads Details:-
PostNuke-0.750-RC3
XTERC
5, XTEThemePack RC5 and Example RC5
PostNuke Team
Generated on June 12, 2004.
-
PostNuke 0.750 Gold RC2 Release
(News)
-
Generated on May 11, 2004.