Debian DSA-2646-1 : typo3-src - several vulnerabilities

high Nessus Plugin ID 65584

Language:

Synopsis

The remote Debian host is missing a security-related update.

Description

TYPO3, a PHP-based content management system, was found vulnerable to several vulnerabilities.

- CVE-2013-1842 Helmut Hummel and Markus Opahle discovered that the Extbase database layer was not correctly sanitizing user input when using the Query object model. This can lead to SQL injection by a malicious user inputing crafted relation values.

- CVE-2013-1843 Missing user input validation in the access tracking mechanism could lead to arbitrary URL redirection.

Note: the fix will break already published links. Upstream advisory TYPO3-CORE-SA-2013-001 has more information on how to mitigate that.

Solution

Upgrade the typo3-src packages.

For the stable distribution (squeeze), these problems have been fixed in version 4.3.9+dfsg1-1+squeeze8.

Plugin Details

Severity: High

ID: 65584

File Name: debian_DSA-2646.nasl

Version: 1.10

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 3/17/2013

Updated: 1/11/2021

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:typo3-src, cpe:/o:debian:debian_linux:6.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 3/15/2013

Reference Information

CVE: CVE-2013-1842, CVE-2013-1843

BID: 58330

DSA: 2646

Detections

Analytics