Full Disclosure mailing list archives
Fixing vulnerabilities in captcha-scripts mentioned in my last advisories
From: "MustLive" <mustlive () websecurity com ua>
Date: Mon, 19 Apr 2010 18:29:25 +0300
Hello Full-Disclosure! Last Friday (16.04.2010) I wrote a letter to Bugtraq, when I was answering to letter of reader of the list, with my recommendations of fixing vulnerabilities in captcha-scripts mentioned in my last advisories. Which is related as to CB Captcha, as to all web applications which include CaptchaSecurityImages.php. Because my letter was still not published at Bugtraq, I decided to send it to Full-Disclosure mailing list, in case if it'll be useful for readers of the list (which is interested in fixing such holes in their captchas). The letter is provided bellow. P.S. When I'll find time, I'll answer at letters of those readers of the list who wrote me recently regarding vulnerabilities in CaptchaSecurityImages.php (so don't worry about that). Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua ----- Original Message ----- From: "MustLive" To: "Matteo Valenza" Cc: <bugtraq () securityfocus com> Sent: Friday, April 16, 2010 11:33 PM Subject: Re: Vulnerability in CB Captcha for Joomla and Mambo Hello Matteo Valenza!
how can i solve this issue quickly ?
There are the next solutions for you: 1. Wait until developers of CB Captcha released new fixed version of the plugin. They are examining this vulnerability for some time already (at least Beat, developer of CB Captcha 2.x, because from two authors only he answered me). But Beat told me, that they will be releasing the new fixed version not very quickly (due to their standardized bugfixing process), so users of CB Captcha will need to wait for new release. 2. Contact Beat and ask him when developers will be releasing new version of plugin and to hurry them. 3. Fix the hole manually. It's the most quickest solution and it's possible that you was asking exactly about it. To fix this vulnerability in CB Captcha you need to do, what I recommend to developers of the plugin - to use standard algorithm of fixing such captcha bypass method, which I called session reusing with constant captcha bypass method and described in details in my MoBiC project in 2007. And it concerns all captcha-programs which are using sessions. The algorithm of fixing this issue in CaptchaSecurityImages.php (and it's concerns to CB Captcha and to all those webapps with this captcha in my last advisories, where I mentioned that) was described by developers of CaptchaSecurityImages.php already at 27.03.2007 at their site (http://www.white-hat-web-design.co.uk/articles/php-captcha.php). For that you need to clear session variable "security_code" (or other name which is used in the code of specific webapp). Use unset($_SESSION['security_code']); in the code when you are processing the form. This solution can be used for all affected web applications mentioned by me in last advisories (that have this hole). But concerning CB Captcha if it works in Joomla 1.0 and Mambo, it doesn't work in Joomla 1.5, because it uses another method to work with sessions and for it another code must be used (for clearing of session). Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua ----- Original Message ----- From: "Matteo Valenza" To: "Susan Bradley" Cc: "MustLive"; <bugtraq () securityfocus com> Sent: Friday, April 16, 2010 8:08 PM Subject: Re: Vulnerability in CB Captcha for Joomla and Mambo how can i solve this issue quickly ? Thanks. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Fixing vulnerabilities in captcha-scripts mentioned in my last advisories MustLive (Apr 19)