Slashdot Mirror

← Back to Stories (view on slashdot.org)

Dangerous VBulletin Exploit In the Wild

Posted by Unknown on from the going-back-to-usenet dept.

An anonymous reader writes "vBulletin is a popular proprietary CMS that was recently reported to be vulnerable to an unspecified attack vector. Although vBulletin has not disclosed the root cause of the vulnerability or its impact, we determined the attacker's methods. The identified vulnerability allows an attacker to abuse the vBulletin configuration mechanism in order to create a secondary administrative account. Once the attacker creates the account, they will have full control over the exploited vBulletin application, and subsequently the supported site."

9 of 43 comments (clear)

  1. Short form: by Minupla · · Score: 5, Informative

    For the TL;DR crowd:

    * Delete /core/install and /install directory in all 4.x and 5.x vBulletin installs or block access to same. Do it now.

    Min

    --
    On the whole, I find that I prefer Slashdot posts to twitter ones because I don't get limited to 140 chars before
    1. Re:Short form: by rsmith-mac · · Score: 3, Insightful

      What's odd is that those directories shouldn't be public in the first place. You're supposed to remove them (or block them) once the install is done and before you turn the forum live.

    2. Re:Short form: by 2fuf · · Score: 4, Insightful

      You're also not supposed to have security compromising settings activated by default, when you manufacture a software product. You know that there will always be people who run it in production straight out of the box.

  2. CMS? by Anonymous Coward · · Score: 3, Informative

    Did vBulletin change or something. I thought vBulletin was forum software, this states CMS. Or is CMS the preferred buzzword du jour?

    Either way, this will mean more spam on lots of forums and more identity theft for those that use the same password for forums and bank accounts. Yawn.

    1. Re:CMS? by liamevo · · Score: 4, Funny

      When vbulletin was bought it was turned into a bloated piece of crap. It's only gotten worse since.

    2. Re:CMS? by trogdor8667 · · Score: 3, Informative

      vBulletin added a CMS and blog component in a previous major rewrite.

  3. Lazy admins? by Anonymous Coward · · Score: 3, Insightful

    When vBulletin itself suggests to remove all install directories after installing vBulletin, I'd put it down to lazy admins who can't be effed removing the said directories when advised to in the first place. Hence the "Be sure to delete the install directories, they are a security risk" disclaimer.

  4. Old news by Reez · · Score: 4, Insightful

    This is old news (2013-08-27) even by Slashdot's standards. Forums that were vulnerable have been probably all hacked (then fixed) already ;)

  5. Re:I got hit by this... by NatasRevol · · Score: 3, Insightful

    Deleting the install directory is a good idea for the install scripts to do.

    --
    There are two types of people in the world: Those who crave closure