Debian DSA-2445-1 : typo3-src - several vulnerabilities

medium Nessus Plugin ID 58541

Language:

Synopsis

The remote Debian host is missing a security-related update.

Description

Several remote vulnerabilities have been discovered in the TYPO3 web content management framework :

- CVE-2012-1606 Failing to properly HTML-encode user input in several places, the TYPO3 backend is susceptible to Cross-Site Scripting. A valid backend user is required to exploit these vulnerabilities.

- CVE-2012-1607 Accessing a CLI Script directly with a browser may disclose the database name used for the TYPO3 installation.

- CVE-2012-1608 By not removing non printable characters, the API method t3lib_div::RemoveXSS() fails to filter specially crafted HTML injections, thus is susceptible to Cross-Site Scripting.

Solution

Upgrade the typo3-src packages.

For the stable distribution (squeeze), these problems have been fixed in version 4.3.9+dfsg1-1+squeeze3.

Plugin Details

Severity: Medium

ID: 58541

File Name: debian_DSA-2445.nasl

Version: 1.10

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 4/2/2012

Updated: 1/11/2021

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.4

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:typo3-src, cpe:/o:debian:debian_linux:6.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 3/31/2012

Reference Information

CVE: CVE-2012-1606, CVE-2012-1607, CVE-2012-1608

BID: 52771

DSA: 2445

Detections

Analytics