Re: Vulnerabilities in WordPress

[julian steward <julian.steward09 () gmail com>]

Wow, this sound serious...


On Sat, Mar 20, 2010 at 8:58 AM, MustLive <mustlive () websecurity com ua>wrote:

> Hello Full-Disclosure!
>
> I want to warn you about vulnerabilities in WordPress.
>
> -----------------------------
> Advisory: Vulnerabilities in WordPress
> -----------------------------
> URL: http://websecurity.com.ua/4016/
> -----------------------------
> Timeline:
>
> 02.03.2010 - found the vulnerabilities.
> 02.03.2010 - didn't informed developers. After I informed WP developers
> about multiple vulnerabilities in WordPress in December 2007 and they
> ignored them - some didn't fix and some hiddenly fixed, without thanking me
> and referencing me (they even didn't mention about those fixed holes in
> release notes on official site) - starting from 2008 I never more inform
> them about vulnerabilities in WordPress. These holes were posted to Bugtraq
> (http://www.securityfocus.com/archive/1/archive/1/485786/100/0/threaded).
> 09.03.2010 - disclosed at my site.
> -----------------------------
> Details:
>
> These are Brute Force and Insufficient Authorization vulnerabilities.
>
> Earlier in 2008 I already wrote about Brute Force vulnerability in
> WordPress
> (http://websecurity.com.ua/2007/), which was found by Kad already in 2007
> (http://securityvulns.ru/Pdocument580.html). And as I found at 02.03.2010
> in
> WordPress 2.9.2 this vulnerability still wasn't fixed. And also I found new
> vulnerabilities in WP.
>
> Brute Force:
>
> There is no protection from picking up of a password (from Brute Force
> attacks) in function of protecting pages/posts by a password.
>
> Insufficient Authorization:
>
> At every page/post in WP it's possible to set a password and these
> passwords
> can be equal. But function of accessing by a password writes global cookie,
> which works for the whole site. And so, after setting the password one time
> for one page/post, it's possible to see all protected pages/posts (with the
> same password, even without knowing that the password matches), because at
> a
> request to them the access will be granted automatically.
>
> Vulnerable are WordPress 2.9.2 and previous versions (all 2.x versions). I
> tested in different versions of WP, particularly in 2.0.11 and 2.9.2.
>
> Best wishes & regards,
> MustLive
> Administrator of Websecurity web site
> http://websecurity.com.ua
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/