[Forum] can old disabled plugins be a security risk?

[sross]

Hi, just curious of the implications of old disabled plugins or products being a security risk. If the plugin has old files on the server can these files be used to compromise security? I have several old plugins that are disabled. I am hesitant to "uninstall" some products as this once crashed my database. So I am thinking the best move it to leave the products and plugins disabled but remove any files related to them in the filesystem. Is this advisable or a waste of time? Thanks

[zascok]

could, would and probably will. Clean those things if not used. What was the plugin that crashed ? Is it one of those "Mark thread as ..." ? If so I can help do uninstall

[sross]

the crash was a while ago and it put me off wanting to do anymore uninstalls. I'll definitely go through and clean out the filesystem though, and I guess instead of uninstall it is safest to just delete the old plugins from the plugins view? This way the database will not be touched and the plugin will be removed? Thanks

[zascok]

yeah remove the it from plugin view it will uninstall the product as well

[sross]

thanks for the info, i am cleaning old stuff out as fast as i can but what is considered more of a risk? old plugin files in the file system or old plugins in the vbulletin forum plugins system?

[Hartmut]

It's always nice to have cleaned up software thou... Disabled plugins and products can be a security risk it's not supported anymore and files of it are left on ftp. Disabled plugins not using any files should be no risk at all.

[sross]

so to clarify if for example i had 10 vulnerable plugins that used 80 files on ftp, and i deleted the 80 files but left the plugins disabled it should not be a risk? Thanks

[liamwli]

so to clarify if for example i had 10 vulnerable plugins that used 80 files on ftp, and i deleted the 80 files but left the plugins disabled it should not be a risk? Thanks

Correct.

[soniceffect]

so to clarify if for example i had 10 vulnerable plugins that used 80 files on ftp, and i deleted the 80 files but left the plugins disabled it should not be a risk? Thanks

That would depend on the security risk IMO. If these files can be accessed/run directly then they may well be a security risk. IMO if something is a vulnerable plugin, unless you know what exactly is vulnerable you should uninstall the plugin and remove all files related to it.

This said however, you should remove all files related to plugins that are no longer used as a matter of cause.

[sross]

are .js files a risk? thanks for all the info guys

[Hartmut]

are .js files a risk? thanks for all the info guys

They could be, yes.

That would depend on the security risk IMO. If these files can be accessed/run directly then they may well be a security risk. IMO if something is a vulnerable plugin, unless you know what exactly is vulnerable you should uninstall the plugin and remove all files related to it.

This said however, you should remove all files related to plugins that are no longer used as a matter of cause.

Of coz that should be removed, but a disabled plugin doesnt effect the code as it's not using the hook of the specific file anymore. Where would you start an exploit then when there is no code for it left?

so to clarify if for example i had 10 vulnerable plugins that used 80 files on ftp, and i deleted the 80 files but left the plugins disabled it should not be a risk? Thanks

That's correct.