-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
AA-2008.0002                  AUSCERT Advisory

                             [Win][UNIX/Linux]
                    Multiple Vulnerabilities in Joomla
                              7 January 2008
- ---------------------------------------------------------------------------

        AusCERT Advisory Summary
        ------------------------

Product:              Joomla
Operating System:     UNIX variants (UNIX, Linux, OSX)
                      Windows
Impact:               Execute Arbitrary Code/Commands
                      Access Privileged Data
                      Increased Privileges
                      Cross-site Scripting
                      Provide Misleading Information
Access:               Remote/Unauthenticated
CVE Names:            CVE-2007-6642 CVE-2007-6643 CVE-2007-6644
                      CVE-2007-6645
Member content until: Monday, February 04 2008

OVERVIEW:

        Multiple vulnerabilities have been reported in Joomla! before 1.5 
        RC4 which could result in complete system compromise.


IMPACT:

        The National Vulnerability Database [1], gives the following
        information regarding these vulnerabilities:

         o CVE-2007-6642: "Multiple cross-site request forgery (CSRF) 
           vulnerabilities in Joomla! before 1.5 RC4 allow remote 
           attackers to (1) add a Super Admin, (2) upload an extension 
           containing arbitrary PHP code, and (3) modify the configuration 
           as administrators via unspecified vectors." [2]
 
         o CVE-2007-6643: "Cross-site scripting (XSS) vulnerability in the 
           com_poll component in Joomla! before 1.5 RC4 allows remote 
           attackers to inject arbitrary web script or HTML via 
           unspecified vectors." [3]

         o CVE-2007-6644: "Joomla! before 1.5 RC4 allows remote 
           authenticated administrators to promote arbitrary users to the 
           administrator group, in violation of the intended security 
           model." [4]

         o CVE-2007-6645: "Unspecified vulnerability in Joomla! before 1.5 
           RC4 allows remote authenticated users to gain privileges via 
           unspecified vectors, aka "registered user privilege escalation 
           vulnerability." [5]    


MITIGATION:

        These issues have been addresses in the release of version 1.5 RC4
        which is available for download from the Joomla! website. [6]


REFERENCES:

        [1] National Vulnerability Database
            http://nvd.nist.gov/

        [2] National Vulnerability Database (CVE-2007-6642)
            http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6642

        [3] National Vulnerability Database (CVE-2007-6643)
            http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6643

        [4] National Vulnerability Database (CVE-2007-6644)
            http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6644

        [5] National Vulnerability Database (CVE-2007-6645)
            http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6645

        [6] Joomla! Projects
            http://joomlacode.org/gf/project/joomla/frs/
           
AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBR4FwaSh9+71yA2DNAQJpGAP/WZn3w1OdTQniAEpk6olL6BrIphvDc3A8
cmgYvP1alQwccgKnyr/s68O9lhEHWBa7LyNdO3STwwokjN9KouPOQsSgc4O1778/
ghOKps3S3TJsk/HClpf7ei57Xv2hyW8jJix7DWvRxkTHYrUo2oHbniEAWy1eht9d
RVDzyyTiVIM=
=892u
-----END PGP SIGNATURE-----