SMF Audio CAPTCHA Security Bypass Vulnerability

Bugtraq ID:	28866
Class:	Design Error
CVE:	CVE-2008-2019
Remote:	Yes
Local:	No
Published:	Apr 21 2008 12:00AM
Updated:	May 07 2015 05:29PM
Credit:	Michael Brooks
Vulnerable:	Simple Machines SMF 1.1.4 Simple Machines SMF 1.1.3 Simple Machines SMF 1.1.2 Simple Machines SMF 1.1.1 Simple Machines SMF 1.1 rc3 Simple Machines SMF 1.1 rc2 Simple Machines SMF 1.1 rc1 Simple Machines SMF 1.1 final Simple Machines SMF 1.0.9 Simple Machines SMF 1.0.8 Simple Machines SMF 1.0.7 Simple Machines SMF 1.0.6 Simple Machines SMF 1.0.5 Simple Machines SMF 1.0.4 Simple Machines SMF 1.0.2 Simple Machines SMF 1.0 -beta5p Simple Machines SMF 1.0 -beta4p Simple Machines SMF 1.0 -beta4.1
Not Vulnerable:

SMF Audio CAPTCHA Security Bypass Vulnerability

SMF (Simple Machine Forum) is prone to a security-bypass vulnerability that occurs in the audio CAPTCHA protocol.

Successfully exploiting this issue may allow attackers to send unsolicited spam or perform other automated attacks.

SMF Audio CAPTCHA Security Bypass Vulnerability

The following exploit code is available:

• /data/vulnerabilities/exploits/smf_captcha.zip

SMF Audio CAPTCHA Security Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

SMF Audio CAPTCHA Security Bypass Vulnerability

References:

• Captcha (Rook Security)
  
• SMF Homepage (SMF )
  
• Deciphering the PHP-Nuke Capthca ([email protected])