oss-security - Re: CVE request: typo3 remote command execution

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1248949213.581681271096700392.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Mon, 12 Apr 2010 14:25:00 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: typo3 remote command execution

Please use CVE-2010-1153

Thanks.

-- 
    JB


----- "Hanno Böck" <hanno@...eck.de> wrote:

> http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-008/
> 
>  The TYPO3 autoloader does not validate passed arguments.
> 
> You are not vulnerable if at least one of following conditions is
> met:
> 
>    1. You are using any other TYPO3 version than 4.3.0, 4.3.1 or 4.3.2
> (+ 
> development releases of 4.4 branch).
>    2. You have at least one of following PHP configuration variables
> set to 
> "off": register_globals ("off" by default, advised to be "off" in
> TYPO3 
> Security Cookbook), allow_url_include ("off" by default) and
> allow_url_fopen 
> ("on" by default)
>    3. You are using Suhosin and haven't put URL schemes in
> configuration 
> variable "suhosin.executor.include.whitelist".
> 
> Possible Impact: A crafted request to a vulnerable TYPO3 installation
> will 
> allow an attacker to load PHP code from an external server and to
> execute it 
> on the TYPO3 installation. 
> -- 
> Hanno Böck		Blog:		http://www.hboeck.de/
> GPG: 3DBD3B20		Jabber/Mail:	hanno@...eck.de
> 
> http://schokokeks.org - professional webhosting

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.