Joomla Password Reset Weakness and Session Fixation Vulnerability

                                                A weakness and a vulnerability have been reported in Joomla, which can be exploited by malicious people to disclose sensitive information and conduct session fixation attacks.

1) The weakness is caused due to password reset tokens being stored in plain text in the database, which can be exploited to reset a user's password if the token can be disclosed (e.g. by exploiting a SQL injection vulnerability).

2 )The vulnerability is caused due to an error in the handling of sessions and can be exploited to hijack another user's session by tricking the user into logging in after following a specially crafted link.

NOTE: Errors in the Installer Migration Script and in handling of Limit and Offset queries were also fixed.

The weakness and the vulnerability are reported in versions prior to 1.5.16.

Solution
Update to version 1.5.16 or later.

Provided and/or discovered by
1) The vendor credits Madis Abel.
2) The vendor credits Raul Siles and Steven Pignataro.

Original Advisory
http://developer.joomla.org/security/news/308-20100423-core-password-reset-tokens.html
http://developer.joomla.org/security/news/309-20100423-core-sessation-fixation.html
http://developer.joomla.org/security/news/310-20100423-core-installer-migration-script.html
http://developer.joomla.org/security/news/311-20100423-core-negative-values-for-limit-and-offset.html