---------------------------------------------------------------------- Use WSUS to deploy 3rd party patches Public BETA http://secunia.com/vulnerability_scanning/corporate/wsus_3rd_third_party_patching/ ---------------------------------------------------------------------- TITLE: TYPO3 Multiple Vulnerabilities SECUNIA ADVISORY ID: SA38668 VERIFY ADVISORY: http://secunia.com/advisories/38668/ DESCRIPTION: Multiple vulnerabilities and a security issue have been reported in TYPO3, which can be exploited by malicious users to disclose potentially sensitive information and conduct script insertion attacks and by malicious people to conduct cross-site scripting attacks and bypass certain security restrictions 1) A security issue exists when a "sys_action" task is set up for creation of new backend users. This can be exploited by the executing backend user to view personal data for any other backend user. 2) Certain unspecified input passed to the TYPO3 backend is not properly sanitised before being stored. This can be exploited to insert arbitrary HTML and script code, which is executed in a user's browser session in context of an affected site when the malicious data is viewed. Successful exploitation requires a valid backend login 3) Certain unspecified input passed via the URL is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. Successful exploitation requires PHP to be installed as a CGI binary. 4) A vulnerability is caused due to an error within the authentication mechanism when several authentication services are configured for frontend users, which can be exploited to bypass the authentication mechanism. Successful exploitation requires knowing the salted hashed password and the "saltedpasswords" system extension to be enabled. The vulnerabilities and the security issue are reported in versions prior to 4.3.2. SOLUTION: Update to version 4.3.2 or later. PROVIDED AND/OR DISCOVERED BY: The vendor credits: 1) Georg Ringer 2) Nikolas Hagelstein, Jelmer de Hen, Marcus Krause and Georg Ringer 3) Henry Sudhof 4) Sven Haertwig ORIGINAL ADVISORY: TYPO3-SA-2010-004: http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-004/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------