Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2012.1091
TYPO3-CORE-SA-2012-005: Several Vulnerabilities in TYPO3 Core
16 November 2012
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: TYPO3
Publisher: TYPO3
Operating System: UNIX variants (UNIX, Linux, OSX)
Windows
Impact/Access: Execute Arbitrary Code/Commands -- Existing Account
Cross-site Scripting -- Existing Account
Access Confidential Data -- Existing Account
Resolution: Patch/Upgrade
Original Bulletin:
http://typo3.org/support/teams-security-security-bulletins/security-bulletins-single-view/article/several-vulnerabilities-in-typo3-core/
- --------------------------BEGIN INCLUDED TEXT--------------------
TYPO3-CORE-SA-2012-005: Several Vulnerabilities in TYPO3 Core
November 08, 2012
Category: TYPO3 Core
Author: Helmut Hummel
Keywords: Cross-Site Scripting, SQL Injection, Information Disclosure
It has been discovered that TYPO3 Core is vulnerable to SQL Injection,
Information Disclosure and Cross-Site Scripting
Component Type: TYPO3 Core
Affected Versions: 4.5.0 up to 4.5.20, 4.6.0 up to 4.6.13, 4.7.0 up to 4.7.5
and development releases of the 6.0 branch.
Vulnerability Types: SQL Injection, Cross-Site Scripting, Information
Disclosure
Overall Severity: Medium
Release Date: November 8, 2012
Vulnerable subcomponent: TYPO3 Backend History Module
Vulnerability Type: SQL Injection, Cross-Site Scripting
Severity: Medium
Suggested CVSS v2.0: AV:N/AC:M/Au:S/C:C/I:C/A:N/E:F/RL:O/RC:C (What's that?)
Problem Description: Due to missing encoding of user input, the history module
is susceptible to SQL Injection and Cross-Site Scripting. A valid backend login
is required to exploit this vulnerability.
Solution: Update to the TYPO3 version 4.5.21, 4.6.14 or 4.7.6 that fix the
problem described!
Credits: Credits go to Thomas Worm who discovered and reported the issue.
Vulnerability Type: Information Disclosure
Severity: Low
Suggested CVSS v2.0: AV:N/AC:L/Au:S/C:P/I:N/A:N/E:F/RL:O/RC:C (What's that?)
Problem Description: Due to a missing access check, regular editors could see
the history view of arbitrary records, only by forging a proper URL for the
History Module. A valid backend login is required to exploit this
vulnerability.
Solution: Update to the TYPO3 version 4.5.21, 4.6.14 or 4.7.6 that fix the
problem described!
Credits: Credits go to Core Team Member Oliver Hader who discovered and fixed
the issue.
Vulnerable subcomponent: TYPO3 Backend API
Vulnerability Type: Cross-Site Scripting
Severity: Low
Suggested CVSS v2.0: AV:N/AC:M/Au:S/C:N/I:P/A:N/E:F/RL:O/RC:C (What's that?)
Problem Description: Failing to properly HTML-encode user input the tree
render API (TCA-Tree) is susceptible to Cross-Site Scripting. TYPO3 Versions
below 6.0 does not make us of this API, thus is not exploitable, if no third
party extension is installed which uses this API. A valid backend login is
required to exploit this vulnerability.
Solution: Update to the TYPO3 version 4.5.21, 4.6.14 or 4.7.6 that fix the
problem described!
Credits: Credits go to Johannes Feustel who discovered and reported the issue.
Vulnerability Type: Cross-Site Scripting
Severity: Low
Suggested CVSS v2.0: AV:N/AC:M/Au:S/C:N/I:P/A:N/E:P/RL:O/RC:C (What's that?)
Problem Description: Failing to properly encode user input, the function menu
API is susceptible to Cross-Site Scripting. A valid backend login is required
to exploit this vulnerability.
Solution: Update to the TYPO3 version 4.5.21, 4.6.14 or 4.7.6 that fix the
problem described!
Credits: Credits go to Richard Brain who discovered and reported the issue.
General Advice: Follow the recommendations that are given in the TYPO3 Security
Guide. Please subscribe to the typo3-announce mailing list.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBUKWPwO4yVqjM2NGpAQL3YA//YdyOLyMkRc6v4HxVFoVTy36qr4482/AI
wEvETTXuErH3k/MoS1Qpl1MDYplcbakebgLM4BrRG/nPABsZuxMUD6HxK6j0c1v9
aAjAQ/r1m+DHxOmH5vcz90pUJYv8TAbNFRjiB24IBBGnaLvaD4lvhQzsKXxLzr+e
gmYdgKdOzxM1gW0tTN9G3g+lwxgg9nQ5E1wybkS2BmYiFMMkVjCzA6HILiCN1our
JKNYtcW1A1LWK3Ovq++oJX+9fGX6uqJKdFVNOxhr3w7uN6y542JHxGus/serdBxg
PVhXHvwNBZdvUCxME/eOLgiKU9Tpb/uKm5d6lrj5kYHd8/OvFTYpvqiwfKA8OSvd
lnQex+OBUrceXYwD1C4gR/UMSQ14y95Z7I0tZ2uSi8odXwcGMnudNHggsf1GVebi
07Es/sTHNSQdJksOOAaLODlj+lFbkW3FgBNZcH0CaBzGG+ANHkftvnGERp/bgMqd
dfM80Os+qtGWngxeKJeDxkhrtZ6wVp4dnHdX27XGdhaPSdw3EvYB+909OSDnOyf+
3NGxy2UtVXhyDIjvluQOFA+yirYxcgcUhJ6knDHBOgoKu0vgTloul/fzFNtE0CX5
MfOG6TcyaEH/vEom6t925rcbtdrVk0fuyzlgkpdhDpHVuPF8FMUhPmuuDZexcIrM
YpEnTkfgz1Y=
=mUhA
-----END PGP SIGNATURE-----