lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 15 Apr 2010 12:11:29 -0700 From: Susan Bradley <sbradcpa@...bell.net> To: MustLive <mustlive@...security.com.ua> Cc: bugtraq@...urityfocus.com Subject: Re: Vulnerability in CB Captcha for Joomla and Mambo Dear Bugtraq. I am an admin of a site that has Captcha that spam gets through and the CPU sucks. Honest question -- are you going to post about every site that has lousy captcha? Would it be faster if us admins that have lousy captcha just outted ourselves first? MustLive wrote: > Hello Bugtraq! > > I want to warn you about security vulnerability in plugin CB Captcha > (plug_cbcaptcha) for component Community Builder (com_comprofiler) for > Joomla and Mambo. The posting of this advisory to mailing lists was > delayed, > because I found that there are two different vulnerable versions of > plugin > developed by different authors, so I needed to inform all authors. > > ----------------------------- > Advisory: Vulnerability in CB Captcha for Joomla and Mambo > ----------------------------- > URL: http://websecurity.com.ua/4087/ > ----------------------------- > Affected products: CB Captcha 1.0.2 and previous versions (developed by > Kotofeich), CB Captcha 2.2 and previous versions (developed by Beat). > ----------------------------- > Timeline: > 17.03.2010 - found vulnerability. > 31.03.2010 - disclosed at my site. > 01.04.2010 - informed developer of CB Captcha 1.x. And because I found > other > version of the plugin by another author, and after checking it later I > informed author of CB Captcha 2.x. > 13.04.2010 - additionally informed developers of Community Builder (both > joomlapolis.com and communitybuilder.ru). > ----------------------------- > Details: > > This is Insufficient Anti-automation vulnerability. > > This plugin is based on captcha script CaptchaSecurityImages.php and I > already reported about vulnerabilities in CaptchaSecurityImages > (http://websecurity.com.ua/4043/). And in plugin plug_cbcaptcha were > fixed > all Insufficient Anti-automation and Denial of Service vulnerabilities > from > original script, except one. > > Insufficient Anti-automation: > > In the plugin it's possible to bypass captcha with using of session > reusing > with constant captcha bypass method (http://websecurity.com.ua/1551/), > which > was described in project Month of Bugs in Captchas. With using of this > method it's possible to bypass protection by sending the same code of > captcha. > > It can be done at all pages where this plugin is used. In CB Captcha 1.x > it's using at registration page, lost password form and lost email > form. In > CB Captcha 2.x, in addition to before-mentioned forms, it's using at > contact > form (in the presence of component CB Contact 1.1) and login form (in the > presence of login module of CB 1.2). > > PoC: > > The PoC for this Insufficient Anti-automation vulnerability was > provided to > developers. Everyone who want can create such PoC from exploit > provided in > above-mentioned article from MoBiC project. > > Best wishes & regards, > MustLive > Administrator of Websecurity web site > http://websecurity.com.ua > >
Powered by blists - more mailing lists