TYPO3 pdf_generator2 Extension Remote Commend Execution and Remote File Disclosure Vulnerabilities

Bugtraq ID:	50304
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 20 2011 12:00AM
Updated:	Oct 21 2011 05:11PM
Credit:	Arnaud Labenne and Thorsten Boock
Vulnerable:	Typo3 pdf_generator2 0.21
Not Vulnerable:	Typo3 pdf_generator2 0.21.1

TYPO3 pdf_generator2 Extension Remote Commend Execution and Remote File Disclosure Vulnerabilities

pdf_generator2 extension for TYPO3 is prone to a remote command-execution and a remote file-disclosure vulnerability.

Attackers may exploit these issues to execute arbitrary commands and access files in the context of the web server.

pdf_generator2 0.21.0 and prior versions are vulnerable.

TYPO3 pdf_generator2 Extension Remote Commend Execution and Remote File Disclosure Vulnerabilities

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

TYPO3 pdf_generator2 Extension Remote Commend Execution and Remote File Disclosure Vulnerabilities

Solution:
Updates are available. Please see the references for more details.

TYPO3 pdf_generator2 Extension Remote Commend Execution and Remote File Disclosure Vulnerabilities

References:

• TYPO3 Homepage (TYPO3)
  
• TYPO3 pdf_generator2- OS Command injection (Dotsafe)
  
• TYPO3 Security Bulletin TYPO3-EXT-SA-2011-016 (Typo3)