SECUNIA ADVISORY ID:
SA31789
VERIFY ADVISORY:
http://secunia.com/advisories/31789/
CRITICAL:
Moderately critical
IMPACT:
Unknown, Brute force
WHERE:
>From remote
SOFTWARE:
Joomla! 1.x
http://secunia.com/advisories/product/5788/
DESCRIPTION:
Some vulnerabilities and a security issue have been reported in
Joomla!, where some have an unknown impact and others can potentially
be exploited by malicious people to conduct brute force attacks.
1) A security issue is caused due to an error when generating random
numbers and can potentially be exploited to guess a generated token
or password.
2) An input validation error exists within JRequest, which can be
exploited to inject certain characters into returned data.
3) An input validation error exists within the "mailto" component
before sending mails.
The vulnerabilities and security issue are reported in versions prior
to version 1.5.7.
SOLUTION:
Update to version 1.5.7.
PROVIDED AND/OR DISCOVERED BY:
1) The vendor credits Stefan Esser.
2) The vendor credits Andrew Eddie.
3) The vendor credits Phil Taylor.
ORIGINAL ADVISORY:
http://www.joomla.org/announcements/release-news/5212-joomla-157-security-release-now-available.html
SECUNIA ADVISORY ID:
SA31457
VERIFY ADVISORY:
http://secunia.com/advisories/31457/
CRITICAL:
Moderately critical
IMPACT:
Security Bypass, Manipulation of data
WHERE:
>From remote
SOFTWARE:
Joomla! 1.x
http://secunia.com/product/5788/
DESCRIPTION:
d3m0n has reported a vulnerability in Joomla!, which can be exploited
by malicious people to bypass certain security restrictions and
manipulate data.
The vulnerability is caused due to improper access restriction in
components/com_user/models/reset.php. This can be exploited to bypass
the authentication mechanism and change the password of the user with
the lowest ID (typically the administrator), without having valid
user credentials.
The vulnerability is reported in all 1.5.x versions prior to 1.5.6.
SOLUTION:
Update to version 1.5.6.
PROVIDED AND/OR DISCOVERED BY:
d3m0n
The vendor credits Marijke Stuivenberg.
ORIGINAL ADVISORY:
Joomla!:
http://developer.joomla.org/security/news/241-20080801-core-password-remind-functionality.html
d3m0n:
http://milw0rm.com/exploits/6234
ทีมจูมล่าลายไทย ได้รีลีสต์ไฟล์ภาษาสำหรับใช้งานบนจูมล่า 1.5.5 แล้ว ซึ่งในแพคเกจของไฟล์ภาษา ได้ถูกสร้างออกมา 3 รูปแบบ ดังนี้
