This issue is SA27714 (severity 1/5) http://secunia.com/advisories/27714/
and FrSIRT/ADV-2007-3941 (severity 1/4) http://www.frsirt.com/english/advisories/2007/3941 too. Secunia advisory lists these workarounds: "Grant only trusted users read access to the "users" table. Restrict access to the "wp-admin" directory (e.g. with ".htaccess")." - Juha-Matti >Right this problem has existed for a long time, but it's not the end of >the world for someone to point it out again I suppose. > >I think it's obvious that there's another main issue here and that's the >way WordPress handles its cookies in general. They are not temporary >sessions that expire or are only valid upon successful authentication. >The cookies work for ever.. or at least until the password changes. If >someone uses an XSS attack to obtain the cookies or sniffs them (most >blogs are just HTTP) they can essentially permanently authenticate. The >same result occurs with being able to read the database. > >Furthermore, one could in theory conduct a bruteforce attack against the >WordPress password by just making normal requests to the blog but changing >the cookies that does the double MD5 of the password. You could in theory >emulate normal continued browsing of the website while sending >MD5(MD5(password)) over and over with each request via the cookie. Other >than perhaps a large increase in browsing of the blog, this could possibly >go unnoticed as an attack -- as it would not be logged anywhere (in most >instances) that the cookies were being presented. Once authenticated into >WordPress, the normal blog pages look different, so it would not require >an attacker to access the Admin area to verify. > >Anyway, good to see the CVE is already there. Maybe better session >management will find its way into WordPress. > > >Steven >http://www.securityzone.org (>..runs on WordPress.. oh noes!) > >> This is CVE-2007-6013 since 19th Nov including WordPress ticket #5367: >> >> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6013 >> >> - Juha-Matti --clip-- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
