Vbulletin Security Issue, is this a SCAM?

[Amenadiel]

Last week I was contacted by a security advisor with the following message (basically): your forum is vulnerable to an exploit which would allow an attacker to gain admin privileges. The software maker (this means Jellsoft I guess) has ignored us so we are contacting you to repair this vulnerability in exchange for a link to our site and a small USD 25 fee.

We rejected the offer and warned him saying we were going to contact the local authorities. His answer was, more or less, that he was withdrawing his offer, because the software vendor finally listened to him and was working on a patch. Until that release, he advised to disable attachments on our forums.

Now now... is this a SCAM or what?

[dodgeboard.com]

Anytime you get contacted asking for money to inoculate your site, it's a scam. This is what you pay your host for-security. The software is secure (for known threats) if you are running 3.8.4 pl1. Forward the email to your host if you are in doubt.

[Final Kaoss]

agreed, this is spam and is definitely a scam. Do not fall for stuff like this.

[Amenadiel]

Yes, I am running 3.8.4PL1, my sysadmin said this is a pathetic scam, but I wanted to hear your opinions nowadays.

Besides, there is no way for a visitor to know which version of VB I am running, so any kind of diagnose is just scareware.

[dodgeboard.com]

Don't worry about it then. You are fine.

You may want to read this Bulletin by Steve. It's very informative and gives you some tips to secure your site:

http://www.vbulletin.com/forum/showthread.php?t=194701