Date: Sat, 18 Oct 2014 11:48:06 +0300 From: Henri Salo <henri@...v.fi> To: oss-security@...ts.openwall.com Cc: TYPO3 Security Team <security@...o3.org> Subject: CVE request: TYPO3-EXT-SA-2014-014 and TYPO3-EXT-SA-2014-015 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, Can I get two 2014 CVEs for following TYPO3 extension vulnerabilities, thank you. http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-014/ It has been discovered that the extension "fal_sftp" (fal_sftp) is susceptible to Improper Access Control. Release Date: October 17, 2014 Affected Versions: 0.2.4, 0.2.5 Vulnerability Type: Improper Access Control Severity: Medium Suggested CVSS v2.0: AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C Problem Description: Configured permissions of newly created files and folders for the sFTP driver are set incorrectly. Solution: Updated version 0.2.6 is available from the TYPO3 extension manager and at http://typo3.org/extensions/repository/download/fal_sftp/0.2.6/t3x/. Please check your existing setup and fix permission if needed! Users of the extension are advised to update the extension as soon as possible. Credits: Credits go to Jost Baron who discovered and reported the issue. - - http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-015/ It has been discovered that the extension "Dynamic Content Elements" (dce) is susceptible to Information Disclosure. Release Date: October 17, 2014 Affected Versions: all versions of 0.7.x, 0.8.x, 0.9.x, 0.10.x, 0.11.4 and below of 0.11.x Vulnerability Type: Information Disclosure Severity: Low Suggested CVSS v2.0: AV:N/AC:L/Au:S/C:P/I:N/A:N/E:H/RL:OF/RC:C Problem Description: The extension provides a functionality to check for extension updates. Along with this functionality, installation environment data is automatically reported to the infrastructure of the extension author without user interaction. Solution: Updated version 0.11.5 is available from the TYPO3 extension manager and at http://typo3.org/extensions/repository/download/dce/0.11.5/t3x/. The new extension version provides a configuration option to enable the described behaviour. Credits: Credits go to Georg Ringer who discovered and reported the issue and Armin Vieweg who quickly responded & resolved this issue. - --- Henri Salo -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iEYEARECAAYFAlRCKUYACgkQXf6hBi6kbk8NiQCfThDCmISqf0/wZtvAnnNfpnkU 8gQAn08njOk/+4STMSkpvkn9KZo9mUI4 =SKx5 -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.