how can i solve this issue quickly ? Thanks. Il giorno 15/apr/2010, alle ore 21.11, Susan Bradley ha scritto: > Dear Bugtraq. > > I am an admin of a site that has Captcha that spam gets through and the CPU sucks. > > Honest question -- are you going to post about every site that has lousy captcha? Would it be faster if us admins that have lousy captcha just outted ourselves first? > > MustLive wrote: >> Hello Bugtraq! >> >> I want to warn you about security vulnerability in plugin CB Captcha >> (plug_cbcaptcha) for component Community Builder (com_comprofiler) for >> Joomla and Mambo. The posting of this advisory to mailing lists was delayed, >> because I found that there are two different vulnerable versions of plugin >> developed by different authors, so I needed to inform all authors. >> >> ----------------------------- >> Advisory: Vulnerability in CB Captcha for Joomla and Mambo >> ----------------------------- >> URL: http://websecurity.com.ua/4087/ >> ----------------------------- >> Affected products: CB Captcha 1.0.2 and previous versions (developed by >> Kotofeich), CB Captcha 2.2 and previous versions (developed by Beat). >> ----------------------------- >> Timeline: >> 17.03.2010 - found vulnerability. >> 31.03.2010 - disclosed at my site. >> 01.04.2010 - informed developer of CB Captcha 1.x. And because I found other >> version of the plugin by another author, and after checking it later I >> informed author of CB Captcha 2.x. >> 13.04.2010 - additionally informed developers of Community Builder (both >> joomlapolis.com and communitybuilder.ru). >> ----------------------------- >> Details: >> >> This is Insufficient Anti-automation vulnerability. >> >> This plugin is based on captcha script CaptchaSecurityImages.php and I >> already reported about vulnerabilities in CaptchaSecurityImages >> (http://websecurity.com.ua/4043/). And in plugin plug_cbcaptcha were fixed >> all Insufficient Anti-automation and Denial of Service vulnerabilities from >> original script, except one. >> >> Insufficient Anti-automation: >> >> In the plugin it's possible to bypass captcha with using of session reusing >> with constant captcha bypass method (http://websecurity.com.ua/1551/), which >> was described in project Month of Bugs in Captchas. With using of this >> method it's possible to bypass protection by sending the same code of >> captcha. >> >> It can be done at all pages where this plugin is used. In CB Captcha 1.x >> it's using at registration page, lost password form and lost email form. In >> CB Captcha 2.x, in addition to before-mentioned forms, it's using at contact >> form (in the presence of component CB Contact 1.1) and login form (in the >> presence of login module of CB 1.2). >> >> PoC: >> >> The PoC for this Insufficient Anti-automation vulnerability was provided to >> developers. Everyone who want can create such PoC from exploit provided in >> above-mentioned article from MoBiC project. >> >> Best wishes & regards, >> MustLive >> Administrator of Websecurity web site >> http://websecurity.com.ua >> >>
