|
|
[ Message Precedent sur la mailing][ Message Suivant sur la mailing][ Precedent dans le fil][ Prochain dans le fil][ Index par Date][ Index par fil]
Re: [Full-disclosure] Abuse of Functionality vulnerabilities in Drupal
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ------------
Timeline:
- ------------
2009.03.05 - disclosed at link://[click]
2009.03.15 - posted to FD (link://[click])
2010.12.20 - MustLive announced at my site.
2010.12.21 - MustLive informed developers.
2011.02.18 - disclosed at MustLive's site.
Justin C. Klein Keane
link://[click]
The digital signature on this message can be confirmed
using the public key at link://[click]
On 02/19/2011 02:28 PM, MustLive wrote:
> Hello list!
>
> I want to warn you about Abuse of Functionality vulnerabilities in Drupal.
>
> -------------------------
> Affected products:
> -------------------------
>
> Vulnerable are Drupal 6.20 and previous versions.
>
> ----------
> Details:
> ----------
>
> Abuse of Functionality (WASC-42):
>
> There is unreliable mechanism of changing password in the system. In user
> profile (link://[click]) it's possible to change password without
> knowing of current password. And even there is protection against CSRF in
> the form, this will not protect against Abuse of Functionality.
>
> Because with using of XSS vulnerabilities it's possible to bypass this
> protection and conduct remote attack for changing of the password (including
> administrator's one). Or at session hijacking via XSS it's possible to get
> into account and change the password. Or it's possible to do that at
> temporarily access to user's computer, from which he logged in to his
> account.
>
> Abuse of Functionality (WASC-42):
>
> Besides two before-mentioned methods (link://[click]),
> there are the next methods for enumerating of logins of the users.
>
> At the forum (link://[click]) logins of the users show, which posted at
> the forum (opened a topic or wrote a comment).
>
> In section Recent posts (link://[click]) at pages "All last posts" and
> "My posts" logins of the users show, which wrote posts at the site. Attack
> is possible to conduct only for logged in users.
>
> In posts of the blog (link://[click]), and also in comments to
> blog posts and other pages of the site (link://[click]) logins of the
> users show, which made a post in blog or made a comment.
>
> In password recovery form (link://[click]) it's possible on find
> existent logins and e-mails of the users at the site. If to send incorrect
> login or e-mail then the message shows "Sorry, ... is not recognized as a
> user name or an e-mail address.", and if to send correct login or e-mail,
> then this message will not show.
>
> ------------
> Timeline:
> ------------
>
> 2010.12.20 - announced at my site.
> 2010.12.21 - informed developers.
> 2011.02.18 - disclosed at my site.
>
> I mentioned about these vulnerabilities at my site
> (link://[click]).
>
> Best wishes & regards,
> MustLive
> Administrator of Websecurity web site
> link://[click]
>
>
>
> Full-Disclosure - We believe in it.
> Charter: link://[click]
> Hosted and sponsored by Secunia - link://[click]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - link://[click]
iPwEAQECAAYFAk1ifhMACgkQkSlsbLsN1gBIGwb/b+4L5kuSZergm1xuNle4JMeC
itwiMfMzmFjWFJojO/+h65iKjkVyzVeZdscZHT+yIXIr0C2WpmxoVukALd184gWB
t3XfGO0cGche3dqZOcCCMHS6thJREKwSNqilxoYV4Wizmz9C2P9OullXhudRIefp
7CxX/O2U7oJgAbnJNNjUGNPotee4SzFCLdwN4KHXNVrCorVIViIPDMZT2BxU6cct
jhp8QFQ5tVXwamdhbA5s+ALnmXc4rvedjYQesrre3c9IAh0IWL/6bYtXcluTDGP7
OJD2Yj5VjnriJSGErsM=
=1WaJ
-----END PGP SIGNATURE-----
Full-Disclosure - We believe in it.
Charter: link://[click]
Hosted and sponsored by Secunia - link://[click]
Archives de la liste de diffusion Secunia
Archives de la liste de diffusion Full Disclosure
| Mini-Tagwall des articles publiés sur SecuObs : | | | | sécurité, exploit, windows, attaque, outil, microsoft, réseau, audit, metasploit, vulnérabilité, système, virus, internet, usbsploit, données, source, linux, protocol, présentation, scanne, réseaux, scanner, bluetooth, conférence, reverse, shell, meterpreter, vista, rootkit, détection, mobile, security, malicieux, engineering, téléphone, paquet, trames, https, noyau, utilisant, intel, wishmaster, google, sysun, libre |
| Mini-Tagwall de l'annuaire video : | | | | curit, security, biomet, metasploit, biometric, cking, password, windows, botnet, defcon, tutorial, crypt, xploit, exploit, lockpicking, linux, attack, wireshark, vmware, rootkit, conference, network, shmoocon, backtrack, virus, conficker, elcom, etter, elcomsoft, server, meterpreter, openvpn, ettercap, openbs, iphone, shell, openbsd, iptables, securitytube, deepsec, source, office, systm, openssh, radio |
| Mini-Tagwall des articles de la revue de presse : | | | | security, microsoft, windows, hacker, attack, network, vulnerability, google, exploit, malware, internet, remote, iphone, server, inject, patch, apple, twitter, mobile, virus, ebook, facebook, vulnérabilité, crypt, source, linux, password, intel, research, virtual, phish, access, tutorial, trojan, social, privacy, firefox, adobe, overflow, office, cisco, conficker, botnet, pirate, sécurité |
| Mini-Tagwall des Tweets de la revue Twitter : | | | | security, linux, botnet, attack, metasploit, cisco, defcon, phish, exploit, google, inject, server, firewall, network, twitter, vmware, windows, microsoft, compliance, vulnerability, python, engineering, source, kernel, crypt, social, overflow, nessus, crack, hacker, virus, iphone, patch, virtual, javascript, malware, conficker, pentest, research, email, password, adobe, apache, proxy, backtrack |
|
|
|
|
|
