Wow, this sound serious...
On Sat, Mar 20, 2010 at 8:58 AM, MustLive <mustl...@websecurity.com.ua>wrote: > Hello Full-Disclosure! > > I want to warn you about vulnerabilities in WordPress. > > ----------------------------- > Advisory: Vulnerabilities in WordPress > ----------------------------- > URL: http://websecurity.com.ua/4016/ > ----------------------------- > Timeline: > > 02.03.2010 - found the vulnerabilities. > 02.03.2010 - didn't informed developers. After I informed WP developers > about multiple vulnerabilities in WordPress in December 2007 and they > ignored them - some didn't fix and some hiddenly fixed, without thanking me > and referencing me (they even didn't mention about those fixed holes in > release notes on official site) - starting from 2008 I never more inform > them about vulnerabilities in WordPress. These holes were posted to Bugtraq > (http://www.securityfocus.com/archive/1/archive/1/485786/100/0/threaded). > 09.03.2010 - disclosed at my site. > ----------------------------- > Details: > > These are Brute Force and Insufficient Authorization vulnerabilities. > > Earlier in 2008 I already wrote about Brute Force vulnerability in > WordPress > (http://websecurity.com.ua/2007/), which was found by Kad already in 2007 > (http://securityvulns.ru/Pdocument580.html). And as I found at 02.03.2010 > in > WordPress 2.9.2 this vulnerability still wasn't fixed. And also I found new > vulnerabilities in WP. > > Brute Force: > > There is no protection from picking up of a password (from Brute Force > attacks) in function of protecting pages/posts by a password. > > Insufficient Authorization: > > At every page/post in WP it's possible to set a password and these > passwords > can be equal. But function of accessing by a password writes global cookie, > which works for the whole site. And so, after setting the password one time > for one page/post, it's possible to see all protected pages/posts (with the > same password, even without knowing that the password matches), because at > a > request to them the access will be granted automatically. > > Vulnerable are WordPress 2.9.2 and previous versions (all 2.x versions). I > tested in different versions of WP, particularly in 2.0.11 and 2.9.2. > > Best wishes & regards, > MustLive > Administrator of Websecurity web site > http://websecurity.com.ua > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ >
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/