How secure is vBulletin?

[enurscape]

I was just wondering how secure vBulletin is, compared with SMF and the other forum solutions.

Please provide proof...

[Cyber Smoke]

I'd say, it heavily depends on the other PHP scripts you're running on your website. Let's say, if vBulletin is 99% safe and some of your other scripts have "holes" in them, then nothing is secure, because of the possibility to make a PHP injection through the other scripts you possess.

[forumguy]

vBulletin is one of the most secure board systems. I'm not sure there is any proof to show you, though. Or explain how to prove it.

[enurscape]

vBulletin is one of the most secure board systems. I'm not sure there is any proof to show you, though. Or explain how to prove it.

Isn't there websites or something which have information about it.

[forumguy]

You can't really explain how secure a board is. You can only rely on what people that use the forum say about it. But vBulletin is secure. If a security hole is discovered an upgrade is released shortly after. But note that nothing is completely secure. That's why we have updates. :)

[Cyber Smoke]

Isn't there websites or something which have information about it.
This site :)

http://www.vbulletin.com/forum/showthread.php?t=221905
http://www.vbulletin.com/forum/showthread.php?t=221907

Regarding the security, a nice post by Steve Machol:
http://www.vbulletin.com/forum/showthread.php?t=172234

[antiekeradio]

I was just wondering how secure vBulletin is, compared with SMF and the other forum solutions.

Please provide proof...

"proof" as in unquestionable, objective data, can only be gathered in a statistical manner.

you could ask yourself the questions:

1- how many boards are running a given program
2- how many hijack/hacker intrusions/other security breaches are being reported, (relative to the number found under 1!!)
3- how long does it take for reported security holes to be fixed

If the relative amount you find under 2, are coupled to a low response time under 3, I think you could say you are looking at a secure forum...

I am totally unaware about these aspects of IPB or SMF forums, but I do know vB scores very well indeed. I have not yet seen a hijack report of any recent version with causes within the scripting of the vB program.
(sometimes password was stolen or other server issues caused security breach, but that's possible in every forum)

[antiekeradio]

our previous boardware did not suffer any actual threat from hackers. I think mainly because it was infrequently used software, but if a problem would exist we would have had big trouble as the support was seriously slow and incapable (1 man in his free time?)

no big updates were made for over 2 years. we moved on!

[ManagerJosh]

Proof is very subjective.

[Paul M]

It's as secure as it can be, and more to the point, is quickly patched when a possible security problem is found.

[Quillz]

I was just wondering how secure vBulletin is, compared with SMF and the other forum solutions.

Please provide proof...
vBulletin is not technically any more secure than any other BBS, but the difference is that vB is a commerical product. So if any exploits are discovered, they are usually fixed within hours. Open source software may take longer.

[Colin F]

Actually, I'd argue that. While I can't comment on other BBSs' code, we've implemented quite some things in order to improve security and prevent stupid mistakes that can turn into security issues. Using one input sanitation class globally for example, or making use of the httponly flag in cookies.

[JakeS]

I was just wondering how secure vBulletin is, compared with SMF and the other forum solutions.

Please provide proof...vBulletin is the way to go, I would go through SMF's source and vBulletin's to find more bugs but vBulletin's are generally hard to find so it would take to long, Yes, no matter where you look if you look at phpbb or smf website they will all say "Yes its secure" Due to they use it its conmen fact, I'm saying its secure due to I went through vBulletin 3.6.4 code looking for security holes and didn't find many.