Re: Vulnerabilities in vBulltin(3.0.7 - 3.5.3) and IPB(2.0.0 -

[Paul Laudanski]

On 4 Feb 2006 h.z@inbox.ru wrote:

> Hi everyone!
> the January 23 me was done work on revealing the criticality in
> forum vBulltin(3.0.7 - 3.5.3) and IPB(2.0.0 - 2.1.4).

Is this poc published and have the vendors been notified?

--
Paul Laudanski, Microsoft MVP Windows-Security
[de] http://de.castlecops.com
[en] http://castlecops.com
[wiki] http://wiki.castlecops.com
[family] http://cuddlesnkisses.com

[Paul Laudanski]

On 4 Feb 2006 h.z@inbox.ru wrote:

> No, I nobody has not reported on this criticality. Let all read
> message on securityfocus.com. poc will possible be on sale only
> narrow circle of the people from russian hacker

So your exploit is not being reported to the vendors and you are going
to sell this?

> The People cash, for safe code if him all time to point to errors that
> they will not learn nor that! And additionally me not advantageously
> that they have quickly heard problem ;)

All about the cash? Where is your ethics?

--
Paul Laudanski, Microsoft MVP Windows-Security
[de] http://de.castlecops.com
[en] http://castlecops.com
[wiki] http://wiki.castlecops.com

[scott@vbulletin.com]

While we take all security reports seriously we have investigated this report and have been unable to find any sort of exploit suggested by the author.

External security audits are performed on a regular basis and we are committed to the fast response and release of patches for any vulnerability, credit is also given where due for any discoveries.

After contacting the author for more information the response we received was that a fee would have to be paid for more information. As a company we refuse to be coerced into paying a ransom given that the author has not been able to demonstrate that the
vulnerability exists, much less a willingness to work with us to ensure a secure product for end users.