ID CVE-2014-9034
Summary wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial of service (CPU consumption) via a long password that is improperly handled during hashing, a similar issue to CVE-2014-9016.
References
Vulnerable Configurations
  • WordPress 3.7.4
    cpe:2.3:a:wordpress:wordpress:3.7.4
  • WordPress 3.8
    cpe:2.3:a:wordpress:wordpress:3.8
  • WordPress 3.8.1
    cpe:2.3:a:wordpress:wordpress:3.8.1
  • WordPress 3.8.2
    cpe:2.3:a:wordpress:wordpress:3.8.2
  • WordPress 3.8.3
    cpe:2.3:a:wordpress:wordpress:3.8.3
  • WordPress 3.8.4
    cpe:2.3:a:wordpress:wordpress:3.8.4
  • WordPress 3.9
    cpe:2.3:a:wordpress:wordpress:3.9
  • WordPress 3.9.1
    cpe:2.3:a:wordpress:wordpress:3.9.1
  • WordPress 3.9.2
    cpe:2.3:a:wordpress:wordpress:3.9.2
  • WordPress 4.0
    cpe:2.3:a:wordpress:wordpress:4.0
CVSS
Base: 5.0 (as of 01-04-2016 - 14:52)
Impact:
Exploitability:
CWE CWE-19
CAPEC
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • XML Nested Payloads
    Applications often need to transform data in and out of the XML format by using an XML parser. It may be possible for an attacker to inject data that may have an adverse effect on the XML parser when it is being processed. By nesting XML data and causing this data to be continuously self-referential, an attacker can cause the XML parser to consume more resources while processing, causing excessive memory consumption and CPU utilization. An attacker's goal is to leverage parser failure to his or her advantage. In most cases this type of an attack will result in a denial of service due to an application becoming unstable, freezing, or crash. However it may be possible to cause a crash resulting in arbitrary code execution, leading to a jump from the data plane to the control plane [R.230.1].
  • XML Oversized Payloads
    Applications often need to transform data in and out of the XML format by using an XML parser. It may be possible for an attacker to inject data that may have an adverse effect on the XML parser when it is being processed. By supplying oversized payloads in input vectors that will be processed by the XML parser, an attacker can cause the XML parser to consume more resources while processing, causing excessive memory consumption and CPU utilization, and potentially cause execution of arbitrary code. An attacker's goal is to leverage parser failure to his or her advantage. In many cases this type of an attack will result in a denial of service due to an application becoming unstable, freezing, or crash. However it is possible to cause a crash resulting in arbitrary code execution, leading to a jump from the data plane to the control plane [R.231.1].
  • XML Client-Side Attack
    Client applications such as web browsers that process HTML data often need to transform data in and out of the XML format by using an XML parser. It may be possible for an attacker to inject data that may have an adverse effect on the XML parser when it is being processed. These adverse effects may include the parser crashing, consuming too much of a resource, executing too slowly, executing code supplied by an attacker, allowing usage of unintended system functionality, etc. An attacker's goal is to leverage parser failure to his or her advantage. In some cases it may be possible to jump from the data plane to the control plane via bad data being passed to an XML parser. [R.484.1]
  • XML Parser Attack
    Applications often need to transform data in and out of the XML format by using an XML parser. It may be possible for an attacker to inject data that may have an adverse effect on the XML parser when it is being processed. These adverse effects may include the parser crashing, consuming too much of a resource, executing too slowly, executing code supplied by an attacker, allowing usage of unintended system functionality, etc. An attacker's goal is to leverage parser failure to his or her advantage. In some cases it may be possible to jump from the data plane to the control plane via bad data being passed to an XML parser. [R.99.1]
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
exploit-db via4
  • description Wordpress < 4.0.1 - Denial of Service. CVE-2014-9034. Dos exploit for php platform
    id EDB-ID:35414
    last seen 2016-02-04
    modified 2014-12-01
    published 2014-12-01
    reporter Javer Nieto and Andres Rojas
    source https://www.exploit-db.com/download/35414/
    title WordPress < 4.0.1 - Denial of Service
  • description WordPress <= 4.0 - Denial of Service Exploit. CVE-2014-9034. Dos exploit for php platform
    id EDB-ID:35413
    last seen 2016-02-04
    modified 2014-12-01
    published 2014-12-01
    reporter SECURELI.com
    source https://www.exploit-db.com/download/35413/
    title WordPress <= 4.0 - Denial of Service Exploit
metasploit via4
description WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial of service (CPU consumption) via a long password that is improperly handled during hashing.
id MSF:AUXILIARY/DOS/HTTP/WORDPRESS_LONG_PASSWORD_DOS
last seen 2019-03-27
modified 2018-10-01
published 2015-01-04
reliability Normal
reporter Rapid7
source https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/wordpress_long_password_dos.rb
title WordPress Long Password DoS
nessus via4
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2014-15560.NASL
    description WordPress 4.0.1 Security Release See: https://wordpress.org/news/2014/11/wordpress-4-0-1/ Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-05
    plugin id 79774
    published 2014-12-07
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79774
    title Fedora 21 : wordpress-4.0.1-1.fc21 (2014-15560)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2014-15526.NASL
    description WordPress 4.0.1 Security Release See: https://wordpress.org/news/2014/11/wordpress-4-0-1/ Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-05
    plugin id 79678
    published 2014-12-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79678
    title Fedora 19 : wordpress-4.0.1-1.fc19 (2014-15526)
  • NASL family CGI abuses
    NASL id WORDPRESS_4_0_1.NASL
    description According to its version number, the WordPress application installed on the remote web server is affected by multiple vulnerabilities : - Multiple unspecified errors exist that could allow cross-site scripting attacks. - An unspecified error exists that could allow cross-site request forgery attacks. - An error exists related to password handling that could allow denial of service attacks. - An unspecified error exists that could allow server-side request forgery attacks. - A hash collision error exists that could allow a user account to be compromised. - An error exists related to password reset processing that could allow a user account to be compromised. - An error exists related to the post or page comment field that could allow persistent cross-site scripting attacks. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2019-02-21
    modified 2018-08-07
    plugin id 79437
    published 2014-11-25
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79437
    title WordPress < 3.7.5 / 3.8.5 / 3.9.3 / 4.0.1 Multiple Vulnerabilities
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-3085.NASL
    description Multiple security issues have been discovered in Wordpress, a web blogging tool, resulting in denial of service or information disclosure. More information can be found in the upstream advisory at - CVE-2014-9031 Jouko Pynnonen discovered an unauthenticated cross site scripting vulnerability (XSS) in wptexturize(), exploitable via comments or posts. - CVE-2014-9033 Cross site request forgery (CSRF) vulnerability in the password changing process, which could be used by an attacker to trick an user into changing her password. - CVE-2014-9034 Javier Nieto Arevalo and Andres Rojas Guerrero reported a potential denial of service in the way the phpass library is used to handle passwords, since no maximum password length was set. - CVE-2014-9035 John Blackbourn reported an XSS in the 'Press This' function (used for quick publishing using a browser 'bookmarklet'). - CVE-2014-9036 Robert Chapin reported an XSS in the HTML filtering of CSS in posts. - CVE-2014-9037 David Anderson reported a hash comparison vulnerability for passwords stored using the old-style MD5 scheme. While unlikely, this could be exploited to compromise an account, if the user had not logged in after a Wordpress 2.5 update (uploaded to Debian on 2 Apr, 2008) and the password MD5 hash could be collided with due to PHP dynamic comparison. - CVE-2014-9038 Ben Bidner reported a server side request forgery (SSRF) in the core HTTP layer which unsufficiently blocked the loopback IP address space. - CVE-2014-9039 Momen Bassel, Tanoy Bose, and Bojan Slavkovic reported a vulnerability in the password reset process: an email address change would not invalidate a previous password reset email.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 79696
    published 2014-12-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79696
    title Debian DSA-3085-1 : wordpress - security update
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DLA-236.NASL
    description In the Debian squeeze-lts version of Wordpress, multiple security issues have been fixed : Remote attackers could... - ... upload files with invalid or unsafe names - ... mount social engineering attacks - ... compromise a site via cross-site scripting - ... inject SQL commands - ... cause denial of service or information disclosure CVE-2014-9031 Jouko Pynnonen discovered an unauthenticated cross site scripting vulnerability (XSS) in wptexturize(), exploitable via comments or posts. CVE-2014-9033 Cross site request forgery (CSRF) vulnerability in the password changing process, which could be used by an attacker to trick an user into changing her password. CVE-2014-9034 Javier Nieto Arevalo and Andres Rojas Guerrero reported a potential denial of service in the way the phpass library is used to handle passwords, since no maximum password length was set. CVE-2014-9035 John Blackbourn reported an XSS in the 'Press This' function (used for quick publishing using a browser 'bookmarklet'). CVE-2014-9036 Robert Chapin reported an XSS in the HTML filtering of CSS in posts. CVE-2014-9037 David Anderson reported a hash comparison vulnerability for passwords stored using the old-style MD5 scheme. While unlikely, this could be exploited to compromise an account, if the user had not logged in after a Wordpress 2.5 update (uploaded to Debian on 2 Apr, 2008) and the password MD5 hash could be collided with due to PHP dynamic comparison. CVE-2014-9038 Ben Bidner reported a server side request forgery (SSRF) in the core HTTP layer which unsufficiently blocked the loopback IP address space. CVE-2014-9039 Momen Bassel, Tanoy Bose, and Bojan Slavkovic reported a vulnerability in the password reset process: an email address change would not invalidate a previous password reset email. CVE-2015-3438 Cedric Van Bockhaven reported and Gary Pendergast, Mike Adams, and Andrew Nacin of the WordPress security team fixed a cross-site-scripting vulnerabilitity, which could enable anonymous users to compromise a site. CVE-2015-3439 Jakub Zoczek discovered a very limited cross-site scripting vulnerability, that could be used as part of a social engineering attack. CVE-2015-3440 Jouko Pynnönen discovered a cross-site scripting vulnerability, which could enable commenters to compromise a site. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-07-06
    plugin id 83918
    published 2015-06-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=83918
    title Debian DLA-236-1 : wordpress security update
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2014-15507.NASL
    description WordPress 4.0.1 Security Release See: https://wordpress.org/news/2014/11/wordpress-4-0-1/ Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-05
    plugin id 79674
    published 2014-12-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79674
    title Fedora 20 : wordpress-4.0.1-1.fc20 (2014-15507)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2014-233.NASL
    description Updated wordpress package fixes security vulnerabilities : XSS in wptexturize() via comments or posts, exploitable for unauthenticated users (CVE-2014-9031). XSS in media playlists (CVE-2014-9032). CSRF in the password reset process (CVE-2014-9033). Denial of service for giant passwords. The phpass library by Solar Designer was used in both projects without setting a maximum password length, which can lead to CPU exhaustion upon hashing (CVE-2014-9034). XSS in Press This (CVE-2014-9035). XSS in HTML filtering of CSS in posts (CVE-2014-9036). Hash comparison vulnerability in old-style MD5-stored passwords (CVE-2014-9037). SSRF: Safe HTTP requests did not sufficiently block the loopback IP address space (CVE-2014-9038). Previously an email address change would not invalidate a previous password reset email (CVE-2014-9039).
    last seen 2019-02-21
    modified 2019-01-02
    plugin id 79613
    published 2014-11-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79613
    title Mandriva Linux Security Advisory : wordpress (MDVSA-2014:233)
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_5E1351788AEB11E4801F0022156E8794.NASL
    description MITRE reports : wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message. wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side request forgery (SSRF) attacks by referring to a 127.0.0.0/8 resource. WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash. Cross-site scripting (XSS) vulnerability in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted Cascading Style Sheets (CSS) token sequence in a post. Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial of service (CPU consumption) via a long password that is improperly handled during hashing, a similar issue to CVE-2014-9016. Cross-site request forgery (CSRF) vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 allows remote attackers to hijack the authentication of arbitrary users for requests that reset passwords.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 80350
    published 2015-01-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80350
    title FreeBSD : wordpress -- multiple vulnerabilities (5e135178-8aeb-11e4-801f-0022156e8794)
packetstorm via4
refmap via4
confirm
debian DSA-3085
mandriva MDVSA-2014:233
mlist [oss-security] 20141125 Re: WordPress 4.0.1 Security Release
sectrack 1031243
Last major update 04-04-2016 - 09:15
Published 25-11-2014 - 18:59
Back to Top