Security Announcements

• Project: Joomla!
• SubProject: All
• Severity: Low
• Versions: 1.5.15 and all previous 1.5 releases
• Exploit type: Unauthorised Access
• Reported Date: 2010-Jan-07
• Fixed Date: 2010-Apr-23

Description

When a user requests a password reset, the reset tokens were stored in plain text in the database. While this is not a vulnerability in itself, it allows user accounts to be compromised if there is an extension on the site with an SQL injection vulnerability.

Affected Installs

All 1.5.x installs prior to and including 1.5.15 are affected.

Solution

Upgrade to the latest Joomla! version (1.5.16 or later)

Contact

The JSST at the Joomla! Security Centre.

• Project: Joomla!
• SubProject: All
• Severity: Moderate
• Versions: 1.5.15 and all previous 1.5 releases
• Exploit type: Session fixation
• Reported Date: 2010-Mar-25
• Fixed Date: 2010-Apr-23

Description

Session id doesn't get modified when user logs in.  A remote site may be able to forward a visitor to the Joomla! site and set a specific cookie.  If the user then logs in, the remote site can use that cookie to authenticate as that user.

Affected Installs

All 1.5.x installs prior to and including 1.5.15 are affected.

Solution

Upgrade to the latest Joomla! version (1.5.16 or later)

Contact

The JSST at the Joomla! Security Centre.

• Project: Joomla!
• SubProject: All
• Severity: Low
• Versions: 1.5.15 and all previous 1.5 releases
• Exploit type: Code upload
• Reported Date: 2009-Dec-30
• Fixed Date: 2010-Apr-23

Description

The migration script in the Joomla! installer does not check the file type being uploaded. If the installation application is present, an attacker could use it to upload malicious files to a server.

Affected Installs

All 1.5.x installs prior to and including 1.5.15 are affected.

Solution

Upgrade to the latest Joomla! version (1.5.16 or later)

Contact

The JSST at the Joomla! Security Centre.

• Project: Joomla!
• SubProject: All
• Severity: Moderate
• Versions: 1.5.15 and all previous 1.5 releases
• Exploit type: information Disclosure
• Reported Date: 2010-Feb-21
• Fixed Date: 2010-Apr-23

Description

If a user entered a URL with a negative query limit or offset, a PHP notice would display revealing information about the system.

Affected Installs

All 1.5.x installs prior to and including 1.5.15 are affected.

Solution

Upgrade to the latest Joomla! version (1.5.16 or later)

Contact

The JSST at the Joomla! Security Centre.

• Project: Joomla!
• SubProject: All
• Severity: Low
• Versions: 1.5.14 and all previous 1.5 releases
• Exploit type: Extension Version Disclosure
• Reported Date: 2009-October-13
• Fixed Date: 2009-Nov-03

Description

It is possible to read the contents of an extension's XML file and find the version number of the installed extension. This could allow people to exploit a known security flaws for a specific version of an extension.

Affected Installs

All 1.5.x installs prior to and including 1.5.14 are affected.

Solution

Turn on Apache mod_rewrite and configure your .htaccess file to filter out XML files. In the htaccess.txt file shipped with version 1.5.15, lines 35-39 contain example code that will deny access to XML files. You can incorporate this code (or similar code) into your .htaccess file. Be sure to test that it does not cause problems on your site.

Contact

The JSST at the Joomla! Security Centre.

• Project: Joomla!
• SubProject: com_content
• Severity: Moderate
• Versions: 1.5.14 and all previous 1.5 releases
• Exploit type: Front-End Editing
• Reported Date: 2009-September-05
• Fixed Date: 2009-November-03

Description

When logged into the front end with Author access, it was possible to replace an article written by another user.

Affected Installs

All 1.5.x installs prior to and including 1.5.14 are affected.

Solution

Upgrade to latest Joomla! version (1.5.15 or newer).

Contact

The JSST at the Joomla! Security Centre.

• Project: Joomla!
• SubProject: Framework
• Severity: Moderate
• Versions: 1.5.12 and all previous 1.5 releases
• Exploit type: Path Disclosure
• Reported Date: 2009-July-21
• Fixed Date: 2009-July-22

Description

Some files were missing the check for JEXEC. These scripts will then expose internal path information of the host.

Affected Installs

All 1.5.x installs prior to and including 1.5.12 are affected.

Solution

Upgrade to latest Joomla! version (1.5.13 or newer).

Contact

The JSST at the Joomla! Security Centre.

• Project: Joomla!
• SubProject: com_mailto
• Severity: Low
• Versions: 1.5.13 and all previous 1.5 releases
• Exploit type: Email
• Reported Date: 2009-July-28
• Fixed Date: 2009-July-30

Description

In com_mailto, it was possible to bypass timeout protection against sending automated emails.

Affected Installs

All 1.5.x installs prior to and including 1.5.13 are affected.

Solution

Upgrade to latest Joomla! version (1.5.14 or newer).

Contact

The JSST at the Joomla! Security Centre.

• Project: Joomla!
• SubProject: TinyMCE editor
• Severity: Critical
• Versions: 1.5.12
• Exploit type: Image File upload
• Reported Date: 2009-July-22
• Fixed Date: 2009-July-22

Description

Tiny browser included with TinyMCE 3.0 editor allowed files to be uploaded and removed without logging in.

Affected Installs

Version 1.5.12 only

Solution

Upgrade to latest Joomla! version (1.5.13 or newer).

Contact

The JSST at the Joomla! Security Centre.

• Project: Joomla!
• SubProject: Site client
• Severity: Moderate
• Versions: 1.5.11 and all previous 1.5 releases
• Exploit type: XSS
• Reported Date: 2009-June-30
• Fixed Date: 2009-June-30

Description

An attacker can inject JavaScript or DHTML code that will be executed in the context of targeted user browser, allowing the attacker to steal cookies. HTTP_REFERER variable is not properly parsed.

Affected Installs

All 1.5.x installs prior to and including 1.5.11 are affected.

Solution

Upgrade to latest Joomla! version (1.5.12 or newer).

Contact

The JSST at the Joomla! Security Centre.

• Project: Joomla!
• SubProject: Site client
• Severity: Moderate
• Versions: 1.5.11 and all previous 1.5 releases
• Exploit type: XSS
• Reported Date: 2009-June-03
• Fixed Date: 2009-June-30

Description

An attacker can inject JavaScript code in a URL that will be executed in the context of targeted user browser.

Affected Installs

All 1.5.x installs prior to and including 1.5.11 are affected.

Solution

Upgrade to latest Joomla! version (1.5.12 or newer).

Contact

The JSST at the Joomla! Security Centre.

• Project: Joomla!
• SubProject: Admin client
• Severity: Moderate
• Versions: 1.5.11 and all previous 1.5 releases
• Exploit type: XSS
• Reported Date: 2009-June-22
• Fixed Date: 2009-June-30

Description

Some files were missing the check for JEXEC.  These scripts will then expose internal path information of the host.

Affected Installs

All 1.5.x installs prior to and including 1.5.11 are affected.

Solution

Upgrade to latest Joomla! version (1.5.12 or newer).

Contact

The JSST at the Joomla! Security Centre.

• Project: Joomla!
• SubProject: com_users
• Severity: Moderate
• Versions: 1.5.10 and all previous 1.5 releases
• Exploit type: XSS
• Reported Date: 2009-April-30
• Fixed Date: 2009-June-02

Description

A XSS vulnerability exists in the user view of com_users in the administrator panel.

Affected Installs

All 1.5.x installs prior to and including 1.5.10 are affected.

Solution

Upgrade to latest Joomla! version (1.5.11 or newer).

Contact

The JSST at the Joomla! Security Centre.

• Project: Joomla!
• SubProject: ja_purity
• Severity: Moderate
• Versions: 1.5.10 and all previous 1.5 releases
• Exploit type: XSS
• Reported Date: 2009-April-06
• Fixed Date: 2009-June-02

Description

A XSS vulnerability exists in the JA_Purity template which ships with Joomla! 1.5.

Affected Installs

All 1.5.x installs prior to and including 1.5.10 are affected.

Solution

Upgrade to latest Joomla! version (1.5.11 or newer).

Contact

The JSST at the Joomla! Security Centre.

• Project: Joomla!
• SubProject: Site client
• Severity: Low
• Versions: 1.5.10 and all previous 1.5 releases
• Exploit type: XSS
• Reported Date: 2009-May-05
• Fixed Date: 2009-June-02

Description

Some values were output from the database without being properly escaped.  Most strings in question were sourced from the administrator panel.

Affected Installs

All 1.5.x installs prior to and including 1.5.10 are affected.

Solution

Upgrade to latest Joomla! version (1.5.11 or newer).

Contact

The JSST at the Joomla! Security Centre.

• Project: Joomla!
• SubProject: com_content
• Severity: Low
• Versions: 1.5.9 and all previous 1.5 releases
• Exploit type: XSS
• Reported Date: 2009-March-12
• Fixed Date: 2009-March-27

Description

A XSS vulnerability exists in the category view of com_content.

Affected Installs

All 1.5.x installs prior to and including 1.5.9 are affected.

Solution

Upgrade to latest Joomla! version (1.5.10 or newer).

Contact

The JSST at the Joomla! Security Centre.

• Project: Joomla!
• SubProject: Multiple
• Severity: Moderate
• Versions: 1.5.9 and all previous 1.5 releases
• Exploit type: XSS and CSRV
• Reported Date: 2009-February-15
• Fixed Date: 2009-March-27

Description

A series of XSS and CSRF faults exist in the administrator application.  Affected administrator components include com_admin, com_media, com_search.  Both com_admin and com_search contain XSS vulnerabilities, and com_media contains 2 CSRF vulnerabilities.  

Affected Installs

All 1.5.x installs prior to and including 1.5.9 are affected.  The com_search XSS vulnerability requires that "Gather Search Statistics" be enabled to be exploitable (Disabled by default).

Solution

Upgrade to latest Joomla! version (1.5.10 or newer).

Contact

The JSST at the Joomla! Security Centre.

• Project: Joomla!
• SubProject: plg_xstandard
• Severity: High
• Versions: 1.5.8 and all previous 1.5 releases
• Exploit type: Directory Traversal
• Reported Date: 2009-January-7
• Fixed Date: 2009-January-9

Description

A crafted request can cause disclosure of the directory structure on the server (including any directory that php has access to).

Affected Installs

All 1.5.x installs prior to and including 1.5.8 are affected.

Solution

Upgrade to latest Joomla! version (1.5.9 or newer).

Contact

The JSST at the Joomla! Security Centre.

• Project: Joomla!
• SubProject: framework
• Severity: Low
• Versions: 1.5.8 and all previous 1.5 releases
• Exploit type: Session Hijacking/
• Reported Date: 2008-November-20
• Fixed Date: 2009-January-9

Description

When running a site under SSL ONLY (the entire site is forced to be under ssl), Joomla! does not set the SSL flag on the cookie.  This can allow someone monitoring the network to find the cookie related to the session.  Please note that all data is still transferred securely.

Affected Installs

1.5.8 and lower installs which are run with SSL only (no non-ssl access).  

Solution

Upgrade to latest Joomla! version (1.5.9 or newer), and set force_ssl in global configuration. Alternatively, the php setting session.secure_cookie can be set in .htaccess or php.ini.  Joomla! (all versions) will respect this setting.

Contact

The JSST at the Joomla! Security Centre.

• Project: Joomla!
• SubProject: com_weblinks
• Severity: Moderate
• Versions: 1.5.7 and all previous 1.5 releases
• Exploit type: XSS
• Reported Date: 2008-November-9
• Fixed Date: 2008-November-10

Description

com_weblinks allows raw HTML into the title and description tags for weblink submissions (from both the administrator and site submission forms). 

Affected Installs

All 1.5.x installs prior to and including 1.5.7 are affected.

Solution

Upgrade to latest Joomla! version (1.5.8 or newer).

Contact

The JSST at the Joomla! Security Centre.

• Project: Joomla!
• SubProject: com_content
• Severity: Moderate
• Versions: 1.5.7 and all previous 1.5 releases
• Exploit type: XSS
• Reported Date: 2008-October-03
• Fixed Date: 2008-November-10

Description

The defaults on com_content article submission allow entry of dangerous HTML tags (script, etc).  This only affects users with access level Author or higher, and only if you have not set filtering options in com_content configuration.

Affected Installs

All 1.5.x installs prior to and including 1.5.7 are affected.

Solution

Upgrade to latest Joomla! version (1.5.8 or newer).

Contact

The JSST at the Joomla! Security Centre.

• Project: Joomla!
• SubProject: libraries
• Severity: High
• Versions: 1.5.6 and all previous 1.5 releases
• Exploit type: Brute Force
• Reported Date: 2008-August-23
• Fixed Date: 2008-September-9

Description

A flaw with the random number generation exists which vastly reduces the entropy of system used random functions. This impacts system generated tokens and passwords. The fix increases entropy, and greatly reduces the chance of a generated token being guessed.

3PD Concerns

3PD extensions which use random number generation must properly seed the random numbers first (See JUserHelper::genRandomPassword() for more information on how to seed) To generate a random string, the following method is recommended: $password = JUtility::getHash( JUserHelper::genRandomPassword() );.

Affected Installs

All 1.5.x installs prior to and including 1.5.6 are affected.

Solution

Upgrade to latest Joomla! version (1.5.7 or newer).

Contact

The JSST at the Joomla! Security Centre.

• Project: Joomla!
• SubProject: com_mailto
• Severity: Low
• Versions: 1.5.6 and all previous 1.5 releases
• Exploit type: Email Spam 
• Reported Date: 2008-August-29 
• Fixed Date: 2008-September-9

Description

The mailto component does not verify validity of the URL prior to sending.

Affected Installs

All 1.5.x installs prior to and including 1.5.6 are affected.

Solution

Upgrade to latest Joomla! version (1.5.7 or newer).

Contact

The JSST at the Joomla! Security Center.

• Project: Joomla!
• SubProject: Multiple
• Severity: Low
• Versions: 1.5.6 and all previous 1.5 releases
• Exploit type: Redirect Spam 
• Reported Date: 2008-August-26 
• Fixed Date: 2008-September-9

Description

Several components utilize a passed in URL to redirect to after processing.  These URLs are not validated prior to the redirect.  A crafted URL can cause the system to redirect to a spam or phishing site.

3PD Concerns

3pd extensions should validate all redirects (where the URL cannot be trusted) using the new JURI method isInternal($url).  JURI::isInternal($url) will return true if the passed in url is a url on the same host as Joomla, or false if it is not.  JURI::isInternal($url) was not available prior to 1.5.7.

Affected Installs

All 1.5.x installs prior to and including 1.5.6 are affected.

Solution

Upgrade to latest Joomla! version (1.5.7 or newer).

Contact

The JSST at the Joomla! Security Centre.

• Project: Joomla!
• SubProject: libraries
• Severity: Critical
• Versions: 1.5.6 and all previous 1.5 releases
• Exploit type: Variable Injection 
• Reported Date: 2008-September-7 
• Fixed Date: 2008-September-9

Description

A flaw in JRequest exists where variables set with JRequest::setVar are not cleaned when fetching the variable at a later point in the request.  This can result in variable injection (unwanted characters injected into returned data).

3PD Concerns

3PD extensions which use JRequest do not need to change anything for proper function.

Affected Installs

All 1.5.x installs prior to and including 1.5.6 are affected.

Solution

Upgrade to latest Joomla! version (1.5.7 or newer).

Contact

The JSST at the Joomla! Security Centre.