Go Back   vb.org Archive > vBulletin 3 Discussion > vB3 General Discussions
Reload this Page Version 3.6.6. | Exploit is out?
FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
Page 1 of 3 1 23
 
Thread Tools Display Modes
  #1  
Old 05-15-2007, 11:27 AM
dadu911 dadu911 is offline
 
Join Date: Apr 2005
Posts: 19
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default Version 3.6.6. | Exploit is out?
I just recently updated to 3.6.6 and I got exploited.

All my threads got renamed to tom and the first post has a picture of tom and a subtitled saying: "owned by tom"

Is there any additional security hacks I can install. It is really getting on my nerves.

Please Help
Reply With Quote
  #2  
Old 05-15-2007, 11:29 AM
Dismounted's Avatar
Dismounted Dismounted is offline
 
Join Date: Jun 2005
Location: Melbourne, Australia
Posts: 15,047
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
This probably isn't vBulletin. Maybe one of your hacks.
Reply With Quote
  #3  
Old 05-15-2007, 11:30 AM
Oblivion Knight's Avatar
Oblivion Knight Oblivion Knight is offline
 
Join Date: May 2002
Location: Sheffield, UK
Posts: 1,757
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Make sure that you and your admins use strong passwords.. Also, check that any other software being run on the server is up-to-date.

It's highly unlikely that it's a security issue with vBulletin 3.6.6
Reply With Quote
  #4  
Old 05-15-2007, 11:43 AM
dadu911 dadu911 is offline
 
Join Date: Apr 2005
Posts: 19
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Hmm I have two hacks installed. HideHack + The Statistic hack. That is all.

I did a login history in Direct Admin, nothing it is just me.

I believe this is a VB Exploit that is currently out.
Reply With Quote
  #5  
Old 05-15-2007, 11:44 AM
Dismounted's Avatar
Dismounted Dismounted is offline
 
Join Date: Jun 2005
Location: Melbourne, Australia
Posts: 15,047
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
If it is, report it on vB.com? If it's just you, maybe someone logged in under you. Check the Admin Logs.
Reply With Quote
  #6  
Old 05-15-2007, 03:55 PM
Oblivion Knight's Avatar
Oblivion Knight Oblivion Knight is offline
 
Join Date: May 2002
Location: Sheffield, UK
Posts: 1,757
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Quote:
Originally Posted by Oblivion Knight View Post
It's highly unlikely that it's a security issue with vBulletin 3.6.6
Ha, I retract that statement..

An XSS calendar exploit was just discovered.
Reply With Quote
  #7  
Old 05-15-2007, 11:23 PM
dadu911 dadu911 is offline
 
Join Date: Apr 2005
Posts: 19
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Well everyone I HATE TO SAY I TOLD YOU SO!!:

vBulletin 3.6.7

As much as we hate to spring another upgrade on you all so soon after the release of vBulletin 3.6.6, an XSS flaw was identified today and in order to maintain our commitment to fix security problems as soon as we become aware of them, we have to release 3.6.7 and a patch for older versions.
Reply With Quote
  #8  
Old 05-15-2007, 11:57 PM
Shazz's Avatar
Shazz Shazz is offline
 
Join Date: Jun 2006
Location: Utah
Posts: 4,758
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Err, Do you have any backups?
Reply With Quote
  #9  
Old 05-16-2007, 02:43 AM
dadu911 dadu911 is offline
 
Join Date: Apr 2005
Posts: 19
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Yep one from 2 weeks ago. We hit 103,000 users but nope now we are back to 97,000 because we got exploited and thats that.

Hopefully VB will test out their software fully before releasing to the public. Any who thanks for the updated version.

ALWAYS BACK UP - Lesson well learned.
Reply With Quote
  #10  
Old 05-16-2007, 03:44 AM
DieselMinded's Avatar
DieselMinded DieselMinded is offline
 
Join Date: Mar 2007
Posts: 1,655
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Wow !
Reply With Quote
Reply
Page 1 of 3 1 23

« Previous Thread | Next Thread »
Thread Tools
Display Modes
Linear Mode Linear Mode

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump


All times are GMT. The time now is 10:40 AM.

Contact Us - Archive - Top

Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2024, vBulletin Solutions Inc.
X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.04285 seconds
  • Memory Usage 2,242KB
  • Queries Executed 11 (?)
More Information
Template Usage:
  • (1)SHOWTHREAD
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (1)ad_showthread_beforeqr
  • (1)ad_showthread_firstpost
  • (1)ad_showthread_firstpost_sig
  • (1)ad_showthread_firstpost_start
  • (1)bbcode_quote
  • (1)footer
  • (1)forumjump
  • (1)forumrules
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (1)navbar
  • (3)navbar_link
  • (120)option
  • (1)pagenav
  • (1)pagenav_curpage
  • (2)pagenav_pagelink
  • (10)post_thanks_box
  • (10)post_thanks_button
  • (1)post_thanks_javascript
  • (1)post_thanks_navbar_search
  • (10)post_thanks_postbit_info
  • (10)postbit
  • (10)postbit_onlinestatus
  • (10)postbit_wrapper
  • (1)spacer_close
  • (1)spacer_open
  • (1)tagbit_wrapper 
Phrase Groups Available:
  • global
  • inlinemod
  • postbit
  • posting
  • reputationlevel
  • showthread
Included Files:
  • ./showthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/functions_bigthree.php
  • ./includes/class_postbit.php
  • ./includes/class_bbcode.php
  • ./includes/functions_reputation.php
  • ./includes/functions_post_thanks.php 
Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • showthread_start
  • showthread_getinfo
  • forumjump
  • showthread_post_start
  • showthread_query_postids
  • showthread_query
  • bbcode_fetch_tags
  • bbcode_create
  • showthread_postbit_create
  • postbit_factory
  • postbit_display_start
  • post_thanks_function_post_thanks_off_start
  • post_thanks_function_post_thanks_off_end
  • post_thanks_function_fetch_thanks_start
  • post_thanks_function_fetch_thanks_end
  • post_thanks_function_thanked_already_start
  • post_thanks_function_thanked_already_end
  • fetch_musername
  • postbit_imicons
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • postbit_display_complete
  • post_thanks_function_can_thank_this_post_start
  • pagenav_page
  • pagenav_complete
  • tag_fetchbit_complete
  • forumrules
  • navbits
  • navbits_complete
  • showthread_complete