Security Notice: Template Runtime Security Patch Released for vBulletin 6.1.6 - 6.2.1

[glennrocksvb]

vBulletin has released a security patch for supported versions 6.1.6 through 6.2.1 to address a vulnerability in the template runtime.

If you are running one of these supported versions, I strongly recommend applying the official security patch as soon as possible.

After reviewing the changes included in the patch, my analysis suggests that the vulnerable code also appears to exist in older versions of vBulletin, including earlier 6.x releases, 5.x, and 4.x. However, this is my technical assessment and not an official statement from vBulletin.

Although the full technical details of the vulnerability have not been publicly disclosed, any unpatched security vulnerability should be treated seriously.

Administrators running older, unsupported versions should be aware that these releases may no longer receive official security updates. If your forum is still on one of these versions, it would be prudent to evaluate whether your installation could be affected and consider your available options, including upgrading to a supported release.

As always, before applying any updates or making changes to your forum, ensure that you have a current backup of both your files and database.

For the official announcement and instructions, please refer to:

https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4509358-security-patch-released-for-vbulletin-6-2-1-6-2-0-and-6-1-6#post4509358

[desmomax]

I think it's pretty easy to figure out what the problem is. Deepseek quickly reported the issue to me, and a check of my database logs revealed several attempts. I think it would be more helpful for everyone if this were publicly disclosed to allow for targeted testing for this vulnerability.

Vulnerability Description

<redacted for security reasons>

[Snowhog]

I think it's pretty easy to figure out what the problem is. Deepseek quickly reported the issue to me,

Would you elaborate? What is Deepseek and how did you use it? Added: Never mind. I won't use it.

Why is DeepSeek banned?

AI Overview

DeepSeek is banned across many government networks (including the U.S. Navy and multiple U.S. states) and university campuses due to severe national security, cybersecurity, and data privacy concerns.
The primary reasons for these restrictions include:

• Weak Security Infrastructure: Cybersecurity researchers flagged that the platform uses outdated and weak encryption methods (such as 3DES) and has undisclosed data transmissions to Chinese state-linked entities.
• Intellectual Property Concerns: DeepSeek has also faced broader technology sector scrutiny—including investigations from competitors like OpenAI—over allegations of inappropriately using existing models to train and build its competing app.
• Data Privacy & Surveillance Risks: Under Chinese intelligence laws, companies are mandated to cooperate with the PRC government. Experts warn that DeepSeek can harvest user data, track keystrokes, and save information on Chinese servers with no legal recourse for Western users.
• Hidden Telecommunication Links: Cybersecurity analyses have found embedded code in the DeepSeek chatbot linked to China Mobile, a state-owned telecommunications company that is blocked in the U.S. due to Pentagon and intelligence concerns .

[desmomax]

I used DeepSeek to analyze the patch and identify the vulnerability they are patching. Through this analysis, I was able to check my database logs to see if there had been any attempts to exploit this vulnerability prior to that point, and I did find some—fortunately, they were unsuccessful. Therefore, using AI tools like DeepSeek (considering that Claude refused to perform the same analysis) allowed me to carry out the necessary checks mentioned above.

Security Issue Description

<redacted for security reasons>

[glennrocksvb]

desmomax I've edited your posts to remove technical details of the vulnerability. Until more users have had an opportunity to apply the official security update or vBulletin publishes additional information, I'd prefer to avoid hosting information that could facilitate exploitation of unpatched forums.

[glennrocksvb]

For anyone using vB 4.x and 5.x, including 6.0-6.1.5, the vulnerability appears to also exist in those older versions based on my unofficial technical assessment. I recommend you to upgrade to the latest version 6.2.1 Patch Level 1 if possible.

If you're running 5.7.5, I also recommend securing your forum by following the official vBulletin recommendation at:

https://forum.vbulletin.com/forum/vbulletin-5-connect/support-issues-questions/4502267-securing-your-vbulletin-5-7-5-site

The most important step there is disabling dangerous PHP functions in php.ini file. This link is also listed under the Useful Links module on the homepage of this forum.