oss-security - Re: CVE request: typo3 remote command execution

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 12 Apr 2010 14:25:00 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: typo3 remote command execution

Please use CVE-2010-1153

Thanks.

-- 
    JB


----- "Hanno Böck" <hanno@...eck.de> wrote:

> http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-008/
> 
>  The TYPO3 autoloader does not validate passed arguments.
> 
> You are not vulnerable if at least one of following conditions is
> met:
> 
>    1. You are using any other TYPO3 version than 4.3.0, 4.3.1 or 4.3.2
> (+ 
> development releases of 4.4 branch).
>    2. You have at least one of following PHP configuration variables
> set to 
> "off": register_globals ("off" by default, advised to be "off" in
> TYPO3 
> Security Cookbook), allow_url_include ("off" by default) and
> allow_url_fopen 
> ("on" by default)
>    3. You are using Suhosin and haven't put URL schemes in
> configuration 
> variable "suhosin.executor.include.whitelist".
> 
> Possible Impact: A crafted request to a vulnerable TYPO3 installation
> will 
> allow an attacker to load PHP code from an external server and to
> execute it 
> on the TYPO3 installation. 
> -- 
> Hanno Böck		Blog:		http://www.hboeck.de/
> GPG: 3DBD3B20		Jabber/Mail:	hanno@...eck.de
> 
> http://schokokeks.org - professional webhosting

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.