vBulletin 3.7.3 PL1 / vBulletin 3.6.11 PL1

A report was published recently pointing to potential flaws within the random number generator in PHP applications who use a weak seed and then go on to disclose any of the random numbers generated. This flaw could allow random numbers within vBulletin to be predicted and under the correct circumstances allow an attacker to obtain access to a user’s account. To resolve this issue, it is necessary to release patch level versions of vBulletin 3.7.3 and 3.6.11.

This original flaw was discovered by Stefan Esser and its application within vBulletin by another individual.

The upgrade process is the same as previous patch level releases - simply download the patch from the Members Area, extract the files and upload to your webserver, overwriting the existing files. There is no upgrade script required.

As with all security-based releases, we recommend that all customers upgrade as soon as possible in order to prevent any potential damage resulting from the flaw being exploited.

Upgrading from 3.7.3 or 3.6.11

If you are already running 3.7.3 or 3.6.11, the process you will be required to follow to make your board immune to this flaw is very simple.

There is no need to run an upgrade script if you are already running 3.7.3 or 3.6.11.

Visit the Patches section of the vBulletin Members’ Area and download either the patch for 3.7.3, or the patch for 3.6.11, according to the version you are currently running, then extract the files from the archive you downloaded, then upload the files to your board via FTP etc., overwriting the existing files. This will update your version to the PL1 release.

Upgrading from Versions Earlier than 3.7.3 or 3.6.11

If you are not already running 3.7.3 or 3.6.11, you should download the most latest version from the Members’ Area and perform an upgrade as normal.

Full instructions for upgrading vBulletin are available here.

Download vBulletin 3.7.3 PL1 or 3.6.11 PL1

As usual, both versions released today are available for all customers with valid, active licenses to download from the vBulletin Members’ Area.

vBulletin Members Area