bugtraq - WordPress <=4.0 Denial of Service Exploit (CVE-2014-9034)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201411290325.sAT3PO3c007816@sf01web3.securityfocus.com>
Date: Sat, 29 Nov 2014 03:25:24 GMT
From: john@...ureli.com
To: bugtraq@...urityfocus.com
Subject: WordPress <=4.0 Denial of Service Exploit (CVE-2014-9034)

author details: John M. (john@...ureli.com)
homepage details: SECURELI.com

Description:

CVE-2014-9034 was published recently, highlighting an issue that “allows remote attackers to cause a denial of service (CPU consumption) via a long password that is improperly handled during hashing” due to phpass usage.

After reviewing the vulnerability, I have developed a proof-of-concept that successfully performs a denial of service attack against wp-includes/class-phpass.php in the affected version numbers:

    before 3.7.5
    3.8.x before 3.8.5
    3.9.x before 3.9.3
    4.x before 4.0.1

There is no other working code published out in the security world that allows replicating the denial of service code, so this is an exclusive world premier. :)

The proof of concept is developed in PHP and is available for download here:

http://secureli.com/wp-content/uploads/2014/11/secureli.com-wordpressed.php_.txt

-John