| Scoutnet vzw http://forum.scoutnet.be/ |
|
| [Drupal] Security announcements: Captcha response validation http://forum.scoutnet.be/viewtopic.php?f=19&t=1758 |
Pagina 1 van 1 |
| Auteur: | To [ 31 Jan 2007 0:00 ] |
| Titel: | [Drupal] Security announcements: Captcha response validation |
------------CAPTCHA - RESPONSE VALIDATION BYPASS------------ * Advisory ID: DRUPAL-SA-2007-006 * Project: Captcha (third-party module) * Version: 4.7.x, 5.x * Date: 2007-Jan-30 * Security risk: Less critical * Exploitable from: Remote * Vulnerability: Captcha bypass ------------DESCRIPTION------------ Captcha validation can be bypassed by manipulating request variables while posting or by providing certain (incorrect) responses. This defeats the purpose of the captcha and makes automated submission possible. ------------VERSIONS AFFECTED------------ * All versions of Captcha 4.7.x prior to Captcha 4.7-1.2. * All versions of Captcha 5.x prior to Captcha 5.x-1.1. Drupal core is not affected. If you do not use the contributed Captcha module, there is nothing you need to do. ------------SOLUTION------------ Install the latest version: * Captcha 4.7.x-1.2 [http://drupal.org/node/114367]. * Captcha 5.x-1.1 [http://drupal.org/node/114366]. See also the Captcha project page [http://drupal.org/project/captcha]. ------------REPORTED BY------------ The Drupal security team. William Smith independently discovered the bypass with "certain (incorrect) responses". ------------CONTACT------------ The security contact for Drupal can be reached at security at drupal.org or via the form at [http://drupal.org/contact]. |
|
| Pagina 1 van 1 | Alle tijden zijn UTC + 1 uur |
| Powered by phpBB® Forum Software © phpBB Group http://www.phpbb.com/ |
|