Re: Vulnerability in CB Captcha for Joomla and Mambo
how can i solve this issue quickly ?
Thanks.
Il giorno 15/apr/2010, alle ore 21.11, Susan Bradley ha scritto:
> Dear Bugtraq.
>=20
> I am an admin of a site that has Captcha that spam gets through and =
the CPU sucks.
>=20
> Honest question -- are you going to post about every site that has =
lousy captcha? Would it be faster if us admins that have lousy captcha =
just outted ourselves first?
>=20
> MustLive wrote:
>> Hello Bugtraq!
>>=20
>> I want to warn you about security vulnerability in plugin CB Captcha
>> (plug_cbcaptcha) for component Community Builder (com_comprofiler) =
for
>> Joomla and Mambo. The posting of this advisory to mailing lists was =
delayed,
>> because I found that there are two different vulnerable versions of =
plugin
>> developed by different authors, so I needed to inform all authors.
>>=20
>> -----------------------------
>> Advisory: Vulnerability in CB Captcha for Joomla and Mambo
>> -----------------------------
>> URL: http://websecurity.com.ua/4087/
>> -----------------------------
>> Affected products: CB Captcha 1.0.2 and previous versions (developed =
by
>> Kotofeich), CB Captcha 2.2 and previous versions (developed by Beat).
>> -----------------------------
>> Timeline:
>> 17.03.2010 - found vulnerability.
>> 31.03.2010 - disclosed at my site.
>> 01.04.2010 - informed developer of CB Captcha 1.x. And because I =
found other
>> version of the plugin by another author, and after checking it later =
I
>> informed author of CB Captcha 2.x.
>> 13.04.2010 - additionally informed developers of Community Builder =
(both
>> joomlapolis.com and communitybuilder.ru).
>> -----------------------------
>> Details:
>>=20
>> This is Insufficient Anti-automation vulnerability.
>>=20
>> This plugin is based on captcha script CaptchaSecurityImages.php and =
I
>> already reported about vulnerabilities in CaptchaSecurityImages
>> (http://websecurity.com.ua/4043/). And in plugin plug_cbcaptcha were =
fixed
>> all Insufficient Anti-automation and Denial of Service =
vulnerabilities from
>> original script, except one.
>>=20
>> Insufficient Anti-automation:
>>=20
>> In the plugin it's possible to bypass captcha with using of session =
reusing
>> with constant captcha bypass method =
(http://websecurity.com.ua/1551/), which
>> was described in project Month of Bugs in Captchas. With using of =
this
>> method it's possible to bypass protection by sending the same code of
>> captcha.
>>=20
>> It can be done at all pages where this plugin is used. In CB Captcha =
1.x
>> it's using at registration page, lost password form and lost email =
form. In
>> CB Captcha 2.x, in addition to before-mentioned forms, it's using at =
contact
>> form (in the presence of component CB Contact 1.1) and login form (in =
the
>> presence of login module of CB 1.2).
>>=20
>> PoC:
>>=20
>> The PoC for this Insufficient Anti-automation vulnerability was =
provided to
>> developers. Everyone who want can create such PoC from exploit =
provided in
>> above-mentioned article from MoBiC project.
>>=20
>> Best wishes & regards,
>> MustLive
>> Administrator of Websecurity web site
>> http://websecurity.com.ua
>>=20
>>=20
討論串 (同標題文章)
完整討論串 (本文為第 7 之 10 篇)：