Slashdot Mirror
OpenSUSE Forums Defaced, Email Addresses Leaked
sfcrazy writes "The openSUSE Forums were hijacked yesterday. An alleged Pakistani hacker who goes by handle H4x0r HuSsY reportedly exploited a vulnerability in the vBulletin 4.2.1 software SuSE uses to host the forum. vBulletin is a proprietary forum software. The openSUSE team notes that user passwords were not compromised. 'Credentials for your openSUSE login are not saved in our application databases as we use a single-sign-on system (Access Manager from NetIQ) for all our services. This is a completely separate system and it has not been compromised by this crack. What the cracker reported as compromised passwords where indeed random, automatically set strings that are in no way connected to your real password.' It's shocking to learn that SUSE/openSUSE are using proprietary forum software vBulleting as well as proprietary single sign on solution."
SuSE was using vBulletin 4.x which has no known fix for the security hole, and they are leaving the forums offline for now. It seems likely they'll be upgrading to the 5.x series.
What, maybe they wanted to pay for something, rather than use the open-source alternative, which isn't always the best choice.
... no it's not shocking, you use the best tool for the job.
People seem to confuse those terms. AFAIK vBulletin is proprietary and charges a reasonable fee to use. I have no idea if the source is available but is appears to be mostly PHP, Javascript, and HTML - so maybe.
Why are major linux distributions relying on proprietary software after the whole BitKeeper fiasco anyway?
No, vBulletin is a software package, or a program, or even "vBulletin is software" -- but never "a software." You don't have "a hardware" or "an information" or "a clothing" -- you have a piece of hardware, a piece of information, a piece of clothing, and a piece of software. Grammar check, please.
The mods on Ubuntu forums hand out refractions like there's no tomorrow. Anyone who has much as criticizes Unity or mentions the embeded sypware gets an immediate refraction.
H4x0r HuSsY. You just can't make this stuff up.
as a long time OpenSuSE user the forum has beed a problem for a very long time
Novel controls it
NOT OPENSUSE !!!!!!
and this has been a long standing problem for the site admins
they really do not control it
as in the VERY LONG STANDING issue of the code and font and css used for the forum topics
one MUST turn off the min. size font used
or use a 9 pt font
that can ONLY be changed by Novel and NOT by the OpenSUSE forum
"I don't pitch OpenSUSE Linux to my friends, i let Microsoft do it for me
I'm just worried it would take lots of extra time and effort to type something like H4x0r HuSsY multiple times a day.
It's shocking to learn that SUSE/openSUSE are using proprietary forum software vBulleting as well as proprietary single sign on solution.
While vBulletin isn't under GPL, it is pretty liberal. You get the source code, you can modify and compile the source code, you may not redistribute it or remove the copyright notices. So, technically while not open source, your real limitation is in being allowed to redistribute it (not removing copyright is part of GPL, too).
vBulletin has pretty much become crap since Internet Brands bought it. Even IPB would be a bit more tolerable...
It was patched to 4.2.2 in October, 4.2.1 had serious issues, even with 4.2.2 there have been 2 security announcements to remove vulnerable files (which are not needed to run the forum).
People need to stop using shit written in PHP,
They got what they deserved, stupid bastards.
NetIQ Access Manager is rock solid and massively scalable. I support multiple systems that use it for over 30 million users. Nothing better for web access management.
In this case it's even better. None of the user authentication data is on the NetIQ appliance. It's all stored on an LDAP server even further back behind additional firewalls.
Send in the Drones
i read that and thought you were talking about democratic party voters
Used insecure proprietary software; got pwned. If the software has pretty GUIs and simple tools, that makes it nicer and easier for the hackers to pwn you.
Best tool for the job? Not if its security sucks.
I know I'm late to the party, but I can't let this one slip :-). So, a bit of Free Software Philosophy 101 to serve up
First off, Stallman's definitions of Software Freedoms:
Secondly the consequence: Nobody but vBulletin is allowed to patch the hole, from a legal standpoint, lacking freedom 1, and thus lacking freedoms 2 and 3. Legally, SUSE cannot modify/improve/patch the software - they can only purchase upgrades.
I leave this here, you know, just in case.
-- "Simplicity is prerequisite for reliability." --Dijkstra
I'm not sure what the license actually says, so I'm not sure if they expressly disallow people from making changes or not. Practically, they couldn't do that, if they are distributing the code then people are able to change it. It might not make sense to change it if you're just going to update at some point in the future, but it's a possibility.
Anyway, the reason I kept posting things like that was because people kept referring to the software as "closed-source" or something like that, when it's not. The source is open, it's just not free. The major difference between vBulletin and any other open-source PHP project is the license, that's it. It's open-source software that isn't free (both kinds).
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black