bugtraq - Re: Vulnerability in CB Captcha for Joomla and Mambo

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20100416140450.16953.qmail@securityfocus.com>
Date: 16 Apr 2010 14:04:50 -0000
From: nant@...mlapolis.com
To: bugtraq@...urityfocus.com
Subject: Re: Vulnerability in CB Captcha for Joomla and Mambo

Hello viewers.

This is Nick (aka nant) - one of the original (not the forked Russian version) CB Captcha plugin developers. We are responsible for version 2.2 that is referenced in the report.

Some facts for those reading:

MustLive notified us on 13.4.2010 - that's 13 days after disclosure.

This should not be classified as any kind of vulnerability as there is no way that any harm can be done to a website using this script.

The CB Captcha 2.2 plugin, as all similar Captcha scripts, are used to insure that human intervention is needed. The "bug" (at best) reported only allows a single user seeing the generated Captcha image, to use its code during the active session period.

There is no harm that can be done to the system using this. Thus while this is a bit of odd behavior it does not represent a asecurity flaw.

This will be fixed however as soon as possible.

Thank you.