Hey there everyone,

If you are using Mambo CMS Please note the following:
Currently, Version 4.5.3h is available in Fantastico, however, due to a recent security flaw in the Mambo CMS version available through CPanel's Fantastico Scripts, we will be disabling the installer until the security update has been included through Fantastico.


Here's the quickest way to patch your Mambo CMS to comply with the recent security update.

1. Go here --> http://secunia.com/advisories/18935/ to read more about it.

2. "Go to Mamboforge for the Security Update"

Depending on the version you have enabled you'll need the patch for either version 4.5.3 or version 4.5.3h.

If you have Version 4.5.3 installed, download:
[li]MamboV4.5.3_SecurityPatch1.zip[/li]
[/list]

If you have Version 4.5.3h installed, download:
[li]MamboV4.5.3h_SecurityPatch1.zip[/li]
[/list]


3. Extract the .zip file to your Desktop.

There will be two folders components and includes

From here we will now install these two files to your account:

FIRST:

• open the components folder, to find the com_content folder
• open the com_content folder, where you will find the content.php file
• upload the new content.php file to your account, replacing the existing content.php file. (It is located in your mambo directory under /components/com_content/)

NEXT:

• open the includes folder, to find the mambo.php file
• upload the new mambo.php file to your account, replacing the existing mambo.php file (located in your mambo directory under /includes/)

Once all that is done, everything should be secured.

If you require assistance with this, please be sure to post back here, or post up on the Mamboserver forums -> http://forum.mamboserver.com/

The following Thread should be of assistance:

http://forum.mamboserver.com/showthread.php?t=73494



I hope this helps.
- Jay

There's the option to upgrade to the most recent version 4.5.3h, and then apply the patch.

Or

visit the following thread at the Mambo forums:

http://forum.mamboserver.com/showthread.php?t=73494

any additional assistance, for older versions would need to be obtained through Mambo forums.

- Jay

Have you any guidance re installations of Joomla (fork of Mambo)? I have Joomla 1.0.8 and 1.0.7 running on Lunarpages servers. These are NOT Mambo 4.5 Stable 1.0.8 or 1.0.7 (Joomla has a new numbering series).

Also, are there specific components and/or modules and/or mambots that are vulnerable?

The list that I received via email from Lunarpages indicated Phil-A-forms and TFSMambo are among the vulnerable components. Comment?

Based on this, you should be OK if running Joomla 1.0.8
Actually it was fixed in 1.0.0

http://forum.joomla.org/index.php/topic,43053.0.html

and

http://forum.joomla.org/index.php/topic,40046.0.html

Unfortunately, it is nearly impossible for a host to be able to auto scan the servers and see if an installation is Joomla or Mambo at this time...

Thats for the email, i had been meaning to upgrade for a while!
There used to be an option in fantastico to convert mambo->joomla, what happened to that?

The nice about rainy weekends is you can get caught up on projects. Updating Mambo was one of them.

As mentioned earlier, I was hesitant to go from 4.5.2.3 to 4.5.3h because I ran into a conflict on another test server. And no, it wasn't hosted by LunarPages. Because this update was security related I figured I should do it anyway.

I backed up all my production files using CuteFTP to my notebook. I then did a compare between the upgrade files and new files using Beyond Compare. There were about 4 files I had customized and I wanted to fold my changed back in. Files like footer.php and english.php.

I then uploaded the 4.5.3h files back to LunarPages. Success! I then installed the security patch which was only 2 files or so.

If you were concerned like I was about the Gzip conflict, I think you're OK.

that option may not be available as Mambo is not available for install through Fantastico at this time.

Once the Mambo security patch is included with Fantastico, I'm sure Mambo, and the Mambo -> Joomla conversion option will be available once again.

- Jay

what server are you on?

- Jay