PT-2008-3539 · Simple Machines · Simple Machines Forum

Jessica Hope · Published 2008-04-30 · Updated 2018-10-11 · CVE-2008-2019

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Simple Machines Forum (SMF) version 1.1.4

Description The issue allows remote attackers to bypass the CAPTCHA test through an automated attack, considering Hamming distances, due to the reliance on "randomly generated static" to prevent brute-force attacks on the WAV file (audio) CAPTCHA.

Recommendations For Simple Machines Forum (SMF) version 1.1.4, consider implementing additional security measures to strengthen the CAPTCHA system, such as enhancing the randomness of the static generation or using alternative CAPTCHA methods. As a temporary workaround, restrict access to sensitive areas of the forum that rely on the CAPTCHA test to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-2019

Affected Products

Simple Machines Forum

References · 9

• 🔥 https://github.com/TheRook/AudioCaptchaBypass-CVE-2008-2019 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-2019 · Security Note
• http://securityreason.com/securityalert/3836 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42150 · Note
• http://simplemachines.org/community/index.php?P=c3696c2022b54fa50c5f341bf5710aa3&topic=236816.0 · Note
• http://rooksecurity.com/blog/?p=6 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2019 · Note
• http://securityfocus.com/archive/1/491128/100/0/threaded · Note
• http://securityfocus.com/bid/28866 · Note