FreeBSD : typo3 -- Multiple vulnerabilities in TYPO3 Core (b9a347ac-8671-11e2-b73c-0019d18c446a)

High Nessus Plugin ID 65068


The remote FreeBSD host is missing one or more security-related updates.


Typo Security Team reports :

Extbase Framework - Failing to sanitize user input, the Extbase database abstraction layer is susceptible to SQL Injection. TYPO3 sites which have no Extbase extensions installed are not affected.
Extbase extensions are affected if they use the Query Object Model and relation values are user generated input. Credits go to Helmut Hummel and Markus Opahle who discovered and reported the issue.

Access tracking mechanism - Failing to validate user provided input, the access tracking mechanism allows redirects to arbitrary URLs. To fix this vulnerability, we had to break existing behaviour of TYPO3 sites that use the access tracking mechanism (jumpurl feature) to transform links to external sites. The link generation has been changed to include a hash that is checked before redirecting to an external URL. This means that old links that have been distributed (e.g. by a newsletter) will not work any more.


Update the affected packages.

See Also

Plugin Details

Severity: High

ID: 65068

File Name: freebsd_pkg_b9a347ac867111e2b73c0019d18c446a.nasl

Version: $Revision: 1.2 $

Type: local

Published: 2013/03/07

Modified: 2013/06/22

Dependencies: 12634

Risk Information

Risk Factor: High

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:typo3, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 2013/03/06

Vulnerability Publication Date: 2013/03/06