Predictable Randomness in GD::SecurityImage

Executive Summary

This vulnerability affects GD::SecurityImage versions up to 1.75 for Perl. The module uses Perl's built-in rand function to generate CAPTCHA challenge text by creating a six-character string from random characters. The rand function is insecure because it produces predictable and reversible outputs, making the CAPTCHA easily bypassable.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if GD::SecurityImage versions through 1.75 are installed on your system. Use commands like 'cpan -D GD::SecurityImage' or 'perl -MGD::SecurityImage -e "print $GD::SecurityImage::VERSION"' to verify the version. If the version is 1.75 or lower, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

If you use GD::SecurityImage for CAPTCHA generation, attackers could predict or reverse-engineer the challenge text, bypassing CAPTCHA protections. This could allow automated spam, brute-force attacks, or unauthorized form submissions on systems relying on this module for security.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves a weak random number generator in a CAPTCHA implementation rather than data handling or security controls.

Useful 0 Not Useful 0

Mitigation Strategies

Update GD::SecurityImage to a patched version that uses a secure random number generator. Apply the patch from Resource 2 or upgrade to a version that includes Crypt::URandom::MonkeyPatch. Alternatively, replace GD::SecurityImage with a more secure CAPTCHA solution.

Useful 0 Not Useful 0