BID:36801

TYPO3 Core Multiple Security Vulnerabilities

Info

TYPO3 Core Multiple Security Vulnerabilities

Bugtraq ID:	36801
Class:	Input Validation Error
CVE:	CVE-2009-3628 CVE-2009-3629 CVE-2009-3630 CVE-2009-3631 CVE-2009-3632 CVE-2009-3633 CVE-2009-3636 CVE-2009-3634 CVE-2009-3635
Remote:	Yes
Local:	No
Published:	Oct 22 2009 12:00AM
Updated:	Nov 05 2009 06:07PM
Credit:	Stefan Schuler, Stefan Esser, Marcus Krause, Jelmer de Hen, Christian Weiske, Marcus Krause, Andreas Schnapp, Chirs John Riley, Bernhard Kraft, Susanne Moog, Sebastian Spooren, and Christian Welzel
Vulnerable:	Typo3 Typo3 4.2.9 Typo3 Typo3 4.2.6 Typo3 Typo3 4.2.4 Typo3 Typo3 4.2.3 Typo3 Typo3 4.2.2 Typo3 Typo3 4.2.1 Typo3 Typo3 4.2 Typo3 Typo3 4.1.12 Typo3 Typo3 4.1.10 Typo3 Typo3 4.1.8 Typo3 Typo3 4.1.7 Typo3 Typo3 4.1.6 Typo3 Typo3 4.1.4 Typo3 Typo3 4.1 Typo3 Typo3 4.0.13 Typo3 Typo3 4.0.12 Typo3 Typo3 4.0.10 Typo3 Typo3 4.0.9 Typo3 Typo3 4.0.8 Typo3 Typo3 4.0.5 Typo3 Typo3 4.0.4 Typo3 Typo3 4.0.3 Typo3 Typo3 4.0.2 Typo3 Typo3 4.0.1 Typo3 Typo3 4.3.0beta1 Typo3 Typo3 4.0 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0

Not Vulnerable:	Typo3 Typo3 4.2.10 Typo3 Typo3 4.1.13 Typo3 Typo3 4.3beta2

Discussion

TYPO3 Core Multiple Security Vulnerabilities

TYPO3 is prone to multiple vulnerabilities, including SQL-injection, cross-site scripting, information-disclosure, frame- and session-hijacking, and shell-command-execution issues.

Note that exploits for some of the issues may require a valid backend login.

Successful exploits may allow attackers to:
- access or modify data
- exploit latent vulnerabilities in the underlying database
- obtain sensitive information
- gain unauthorized access to the affected application
- execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site
- hijack user sessions
- execute arbitrary commands in the context of the webserver process

A successful attack will compromise the application and may help in further attacks.

The issues affect the following TYPO3 versions:

4.0.13 and earlier
4.1.12 and earlier
4.2.9 and earlier
4.3.0beta1 and earlier

Exploit / POC

TYPO3 Core Multiple Security Vulnerabilities

An attacker can exploit these issues through a browser. To exploit the cross-site scripting issue, an attacker must entice an unsuspecting user to visit a malicious site.

Solution / Fix

TYPO3 Core Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

Debian Linux 4.0 arm