HEARTBLEED BUG!!

[Barcham]

I have been hearing an awful lot about this new bug in the last couple of days and I was wondering if this is something we have to worry about looking into on our vbulletin boards. Does anyone know if this is a bug that can affect us and is there any action we should be taking to secure our boards?

http://heartbleed.com/

The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet for applications such as web, email, instant messaging (IM) and some virtual private networks (VPNs).

The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users.

[BirdOPrey5]

This bug isn't at all related to vBulletin.

If your vBulletin forum happens to run on a web server that is using a secure, https, connection then you may want to check with your host to confirm they have patched the system if they were vulnerable.

[Adrian Schneider]

If you are running a webserver, especially a VPS or higher, you are probably vulnerable unless you've explicitly upgraded openssl or if you know your host has for you. It's not just https, there's also SSH, and even if you aren't using https, cpanel probably is.

I'd be worried whether I had vBulletin, XenForo, Wordpress or any other software on a public-facing web service.

[CAG CheechDogg]

This is something that mostly every host has already patched by now, I use HostGator and they have everything patched up already ...check with your host or simply got to your host's site and they will have a site checker for this which will tell you right away if your site is safe ...for HostGator account holders they can use the following link to check their site:

http://heartbleed.hostgator.com/

[Max Taxable]

If you're skeered a site you go to might have this exploit, just test it here.

http://filippo.io/Heartbleed/