New vBulletin zero-day could infect thousands of sites worldwide

An anonymous security researcher has published details about a zero day online in the popular Internet forum software vBulletin.

Following the disclosure, security experts have worried that by posting details about the vulnerability without patches, the anonymous investigator may have triggered an incoming wave of piracy of forums over the Internet that could see pirates Computer experts take over the forums and steal the information contained in them in bulk.

The analysis of the published code has revealed that zero day allows an attacker to execute shell commands on a server running a vBulletin installation. The vulnerability is quite serious since an attacker does not even need to have an account in a specific forum to launch an attack against him.

The zero day discovered in vBulletin is known as remote code execution vulnerability prior to authentication and is one of the worst types of security flaws that can affect a web-based platform.

Anonymous Disclosure

Details on day zero in vBulletin were published on the publicly accessible mailing list, Full Disclosure.

Security Investigators often reveal vulnerabilities after informing a company and giving them enough time to correct the fault. However, in this case, it is still unclear whether the anonymous investigator reported the vulnerability directly to the vBulletin team or if they revealed the vulnerability after the company did not resolve the problem quickly enough. Typically, security researchers give companies at least 90 days to repair vulnerabilities before exposing them publicly.

At the same time, the disclosure could also have been an act of malicious or intentional sabotage with the investigator trying to damage the reputation of MH Sub I, the company behind vBulletin. The researcher was able to hide his identity by publishing details about the zero day by using an anonymous email service. However, if the investigator had reported the company directly on day zero, they could have received a reward for errors worth $ 10,000 according to the MH Sub I price chart.

About 0.1 percent of all sites Internet have a forum powered by vBulletin and this number may seem small, but billions of Internet users could be affected by this zero day. Fortunately, zero day only affects forums that run vBulletin 5.x, so forums that run earlier versions are safe.

Users in charge of a vBulletin forum should first verify which version of the software they are running and if they are using the latest version, security researchers have released an unofficial patch to mitigate zero day.

Via ZDNet

For More Updates Check out Blog, Windows Softwares Drivers, Antivirus, Ms Office, Graphic Design Don’t Forget to Look Our Facebook Page Get Into Pc like us & follow on Twitter- @getinpc

Please Note: This content is provided and hosted by a 3rd party server. Sometimes these servers may include advertisements. igetintopc.com does not host or upload this material and is not responsible for the content.