bugtraq - Vulnerabilities in WordPress

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 19 Mar 2010 23:57:16 +0200
From: "MustLive" <mustlive@...security.com.ua>
To: <bugtraq@...urityfocus.com>
Subject: Vulnerabilities in WordPress

Hello Bugtraq!

I want to warn you about vulnerabilities in WordPress.

-----------------------------
Advisory: Vulnerabilities in WordPress
-----------------------------
URL: http://websecurity.com.ua/4016/
-----------------------------
Timeline:

02.03.2010 - found the vulnerabilities.
02.03.2010 - didn't informed developers. After I informed WP developers
about multiple vulnerabilities in WordPress in December 2007 and they
ignored them - some didn't fix and some hiddenly fixed, without thanking me
and referencing me (they even didn't mention about those fixed holes in
release notes on official site) - starting from 2008 I never more inform
them about vulnerabilities in WordPress. These holes were posted to Bugtraq
(http://www.securityfocus.com/archive/1/archive/1/485786/100/0/threaded).
09.03.2010 - disclosed at my site.
-----------------------------
Details:

These are Brute Force and Insufficient Authorization vulnerabilities.

Earlier in 2008 I already wrote about Brute Force vulnerability in WordPress
(http://websecurity.com.ua/2007/), which was found by Kad already in 2007
(http://securityvulns.ru/Pdocument580.html). And as I found at 02.03.2010 in
WordPress 2.9.2 this vulnerability still wasn't fixed. And also I found new
vulnerabilities in WP.

Brute Force:

There is no protection from picking up of a password (from Brute Force
attacks) in function of protecting pages/posts by a password.

Insufficient Authorization:

At every page/post in WP it's possible to set a password and these passwords
can be equal. But function of accessing by a password writes global cookie,
which works for the whole site. And so, after setting the password one time
for one page/post, it's possible to see all protected pages/posts (with the
same password, even without knowing that the password matches), because at a
request to them the access will be granted automatically.

Vulnerable are WordPress 2.9.2 and previous versions (all 2.x versions). I
tested in different versions of WP, particularly in 2.0.11 and 2.9.2.

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua