Just updated to Drupal 5.10 easy as pie. Tried to go to 6.4, but UVa's sql server is too old a version for that.
But such an easy install: Drag it over and run the update script and done!
So the site should be secure again now.