Alpine Spirit
04-08-2007, 09:25 AM
OK I think I may have found the recent problem.
Apparently some virus programs and browsers were shutting down when accessing the bulletin board.
This was a result of a possible security hole found in VBulletin. It did not work they way the attackers had wanted but caused access issues and browser crash.
It is worth noting that in order to exploit the problem highlighted by the report, the attacking user must satisfy the following conditions:
* Must already have moderator privileges
* Must share the same IP address (or the number of IP octets specified in the Admin Control Panel for IP address matching) with an existing administrator who is currently logged in to the Admin Control Panel
* Must know the Alt-IP and user agent (exact browser identification) of the administrator
* OR must know the license number of the site being attacked
Given these requirements, the privilege escalation exploit claimed by the report is almost impossible to achieve.
If you run into more problem please copy the error code(s) and paste them here.
Our version now has the patch installed (as of 4/8/2007 @ 9:10am) so we should be fine.
Apparently some virus programs and browsers were shutting down when accessing the bulletin board.
This was a result of a possible security hole found in VBulletin. It did not work they way the attackers had wanted but caused access issues and browser crash.
It is worth noting that in order to exploit the problem highlighted by the report, the attacking user must satisfy the following conditions:
* Must already have moderator privileges
* Must share the same IP address (or the number of IP octets specified in the Admin Control Panel for IP address matching) with an existing administrator who is currently logged in to the Admin Control Panel
* Must know the Alt-IP and user agent (exact browser identification) of the administrator
* OR must know the license number of the site being attacked
Given these requirements, the privilege escalation exploit claimed by the report is almost impossible to achieve.
If you run into more problem please copy the error code(s) and paste them here.
Our version now has the patch installed (as of 4/8/2007 @ 9:10am) so we should be fine.