security bug report Unassigned/Unconfirmed for >1 week (vb3/vb4)

[lim (x³-7x²) = ∞]

http://tracker.vbulletin.com/browse/VBIII-12799

I reported this problem 1 year ago on forum
Recently, because of this problem too many real admin passwords (not just hashes) leaked after faq.php incident (via phpmyadmin)
I reported this problem again on previous week on bug tracker, and it is still Unassigned/Unconfirmed for more then 7 days.

Problem in short: anyone with database read access (hoster, forum admins, admins of other websites on shared hosting, or hackers, like in case of faq.php incidents) will be able to decode easily very high percent of real passwords (not just hashes), because password protecting hashing feature not doing its work

[GameFreak2009]

This is pretty serious if I hear you saying it. Never thought about it though...

I hope the team sees this pretty soon.

[smiggy]

How can a security bug like this be missed?

[feldon23]

It's not a bug. It's not a vulnerability. It's a situation. How do you "bug report" a situation?

I do not know a completely impervious encryption or hashing system for passwords.

The "solution" I see to this is to tell every vb3.8 site admin to post an announcement on their forums suggesting that users change their passwords because there is a 1/9586342964538643 chance that someone could put in enough effort to crack their password.

I do understand the issues that most users use the same password on every site, from forums to banking accounts.

Once access to your MySQL database has been acquired, you're pretty much screwed. This has been this way for 10 years now. I remember when passwords in vBulletin went from plaintext to hashed (around vB 2.2).

[Steve Machol]

The salt was increased from 3 characters to 30 characters in 3.7.7, 3.8.5, 4.0.2 and all subsequent versions as per this announcement:

http://www.vbulletin.com/forum/showthread.php?346486-Security-Fix-Releases-3.7.7-and-4.0.2-PL-2

Also brute force attacks are easily thwarted by enabling the strikes system.

[hornstar6969]

I use the strikes system on only my staff usergroups. But many of them hate it lol. But it is indeed a useful feature in this event.

[Lizard King]

This is not a security issue imo.

[compwhizii]

This is not some dire situation like you make it out to be.

[Yves R.]

And bug scrubbers are seeing bugs for 4.x only, not 3.x.