oss-security - CVE request: TYPO3-EXT-SA-2014-014 and TYPO3-EXT-SA-2014-015

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Sat, 18 Oct 2014 11:48:06 +0300
From: Henri Salo <henri@...v.fi>
To: oss-security@...ts.openwall.com
Cc: TYPO3 Security Team <security@...o3.org>
Subject: CVE request: TYPO3-EXT-SA-2014-014 and TYPO3-EXT-SA-2014-015

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

Can I get two 2014 CVEs for following TYPO3 extension vulnerabilities, thank you.

http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-014/

It has been discovered that the extension "fal_sftp" (fal_sftp) is susceptible to
Improper Access Control.

Release Date: October 17, 2014
Affected Versions: 0.2.4, 0.2.5
Vulnerability Type: Improper Access Control
Severity: Medium
Suggested CVSS v2.0: AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C

Problem Description: Configured permissions of newly created files and folders
for the sFTP driver are set incorrectly.

Solution: Updated version 0.2.6 is available from the TYPO3 extension manager
and at http://typo3.org/extensions/repository/download/fal_sftp/0.2.6/t3x/.
Please check your existing setup and fix permission if needed! Users of the
extension are advised to update the extension as soon as possible.

Credits: Credits go to Jost Baron who discovered and reported the issue.

- -

http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-015/

It has been discovered that the extension "Dynamic Content Elements" (dce) is
susceptible to Information Disclosure.

Release Date: October 17, 2014
Affected Versions: all versions of 0.7.x, 0.8.x, 0.9.x, 0.10.x, 0.11.4 and below
of 0.11.x

Vulnerability Type: Information Disclosure
Severity: Low
Suggested CVSS v2.0: AV:N/AC:L/Au:S/C:P/I:N/A:N/E:H/RL:OF/RC:C

Problem Description: The extension provides a functionality to check for
extension updates. Along with this functionality, installation environment data
is automatically reported to the infrastructure of the extension author without
user interaction.

Solution: Updated version 0.11.5 is available from the TYPO3 extension manager
and at http://typo3.org/extensions/repository/download/dce/0.11.5/t3x/. The new
extension version provides a configuration option to enable the described
behaviour.

Credits: Credits go to Georg Ringer who discovered and reported the issue and
Armin Vieweg who quickly responded & resolved this issue. 

- ---
Henri Salo
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlRCKUYACgkQXf6hBi6kbk8NiQCfThDCmISqf0/wZtvAnnNfpnkU
8gQAn08njOk/+4STMSkpvkn9KZo9mUI4
=SKx5
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.