vb 3.6.5 is released

03-02-2007, 02:35 AM

;););)

We need on official version to null it

http://www.vbulletin.com/forum/showt...22#post1314422

http://www.vbulletin.com/forum/showthread.php?t=221907

03-03-2007, 03:12 AM

i see the new release but you must understand that the new version doesnt contain any new options. There is an exploit for VB 3.5.x - 3.6.x but the exploit requires the following conditions to be carried out.
It is worth noting that in order to exploit the problem highlighted by the report, the attacking user must satisfy the following conditions:

Must already have moderator privileges
Must share the same IP address (or the number of IP octets specified in the Admin Control Panel for IP address matching) with an existing administrator who is currently logged in to the Admin Control Panel
Must know the Alt-IP and user agent (exact browser identification) of the administrator
OR must know the license number of the site being attacked

Given these requirements, the privilege escalation exploit claimed by the report is almost impossible to achieve.

Now you must ask yourself, "should i upgrade for an exploit that is very unprobbable? or should I wait till a new version comes out with more options for users and admins.

I would wait for a better version. Changing isnt worth it at this point.

my 2¢