Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 23 Jan 2009 18:24:20 +0100
From: Nico Golde <oss-security+ml@...lde.de>
To: oss-security@...ts.openwall.com
Subject: Re: CVE id request: typo3 SA-2009-001

Hi,
* Steven M. Christey <coley@...us.mitre.org> [2009-01-23 13:09]:
[...] 
> ======================================================
> Name: CVE-2009-0258
> Status: Candidate
> URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0258
> Reference: CONFIRM:http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-001/
> Reference: BID:33376
> Reference: URL:http://www.securityfocus.com/bid/33376
> Reference: SECUNIA:33617
> Reference: URL:http://secunia.com/advisories/33617
> Reference: XF:typo3-indexedsearch-command-execution(48138)
> Reference: URL:http://xforce.iss.net/xforce/xfdb/48138
> 
> Unspecified vulnerability in the Indexed Search Engine
> (indexed_search) system extension in TYPO3 4.0.0 through 4.0.9, 4.1.0
> through 4.1.7, and 4.2.0 through 4.2.3 allows remote attackers to
> execute arbitrary commands via unknown vectors related to the
> command-line indexer.

Thanks for the ids!
I am just working on a security update for typo3. Looking at 
the patch used for CVE-2009-0258 it is pretty obvious that 
this is exploitable via a crafted filename which is passed 
to various system utilities to get information of the file 
content.

Cheers
Nico
-- 
Nico Golde - http://www.ngolde.de - nion@...ber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ