High-severity vulnerability in vBulletin is being actively exploited

Mike_04GolfTDI · September 26th, 2019, 08:27

https://arstechnica.com/information-...vbulletin-bug/

The patch for this was released only yesterday. What is the status of TDI Club's software?

This should be of concern to anyone who has any personal information on the site. Apparently hackers can take control of the server with a known exploit.

B3achbum · September 26th, 2019, 11:06

Thanks for posting, I just read same article...
Hope admins/hosting catch on quickly!!!

Mike_04GolfTDI · September 26th, 2019, 14:13

I sent PM to Fred also.

turbocharged798 · September 27th, 2019, 06:38

Especially since this site is running a very old version of Vbulletin that it would be quite vulnerable I would think.

bhtooefr · September 27th, 2019, 07:38

If the article is accurate, the bug may only affect vBulletin 5.0+?

Considering TDIClub's on the 3.8 branch - which is quite outdated and insecure - it may not be vulnerable to this specific vulnerability?

BobnOH · September 27th, 2019, 10:55

Quote:

Originally Posted by bhtooefr

.....................snip.........................
Considering TDIClub's on the 3.8 branch - which is quite outdated and insecure - it may not be ..........snip...........

LOL Now you're just trying to scare us.
So I guess best practice is to not share any info you don't want seen by anyone, good practice for any social media.

sjjubb1989 · October 4th, 2019, 07:06

I work in cybersecurity now and have experience in managing servers, patching, etc.

I'd be more than happy to purchase the license to upgrade these forums to the latest version of vBulletin (Approx $210US to an upgrade license) if the owner was willing to put the time in to update it.

https://www.vbulletin.com/en/features/

I haven't been an active member here for a long time, I logged in for the first time in nearly 10 years but have been a frequent reader of these forums.

I'd volunteer my services, etc, however if this were my forum I wouldn't trust a random person on the internet to manage my site & servers.

It'd be a shame to see this site go away or get hacked, it is a wealth of information that would be missed.

Edit: Also is this hosted via a web hosting company or in a cloud environment? Other things that should be looked at is the current version of Apache and PHP, as well as any plugins.

BobnOH · October 4th, 2019, 13:47

Quote:

Originally Posted by sjjubb1989

I work in cybersecurity now and have experience in managing servers, patching, etc.

I'd be more than happy to purchase the license to upgrade these forums to the latest version of vBulletin (Approx $210US to an upgrade license) if the owner was willing to put the time in to update it.

https://www.vbulletin.com/en/features/

I haven't been an active member here for a long time, I logged in for the first time in nearly 10 years but have been a frequent reader of these forums.

I'd volunteer my services, etc, however if this were my forum I wouldn't trust a random person on the internet to manage my site & servers.

It'd be a shame to see this site go away or get hacked, it is a wealth of information that would be missed.

Edit: Also is this hosted via a web hosting company or in a cloud environment? Other things that should be looked at is the current version of Apache and PHP, as well as any plugins.

Contact Fred, or a moderator (listed at the bottom when they're here) or wait until they see this. They're pretty laid back, wonderful forum. Guessing it's web hosted on their machine.

sjjubb1989 · October 23rd, 2019, 07:59

*Bump*