My guess (pretty much confirmed by moonie's post) is XSS exploits. With VBulliten 3 came increased support for cross site scripting, which (expolits have been around for a long time) lets you able to easily take cookies.
A well crafted pm/thread does not even need you to click a link to steal your session (and since Vbulliten sessions are perminant, its pretty deadly)
I'm not aware of a release to fix it, or any automatic way to disable the XSS, I suggest downgrading the forum personally =p
Disable html everywhere on the forum for starters. (I believe this has been done)
The bad news for us "non moderators" is many of us have our graal passwords set as our forums passwords... yeah...
http://www.securityfocus.com/bid/9943 is an example, there are many.
*edit
okay after reading around, i see it was angels pass stolen... Protect the forums against the above anyway =p
04-26-2004, 04:58 PM
Threaded Mode