=====================================================================
                                    CERT-Renater

                         Note d'Information No. 2008/VULN184
_____________________________________________________________________

DATE                      : 28/05/2008

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Systems running TYPO3 with sg_zfelib,
                                                   kj_imagelightbox2.

======================================================================
http://typo3.org/teams/security/security-bulletins/typo3-20080527-2/
http://typo3.org/teams/security/security-bulletins/typo3-20080527-1/
______________________________________________________________________

TYPO3 Security Bulletin TYPO3-20080527-2: SQL Injection in extension 
"Library for Frontend plugins" (sg_zfelib)

Component Type: Third party extension. This extension is not part of the 
TYPO3 default installation.

Affected Versions: Version 1.1.512 and below

Vulnerability Type: SQL Injection

Severity: High

Problem Description: Failing to filter user input the extension is
susceptible to SQL Injections making it possible to get read access to
the database.

Solution: An updated version 1.1.513 is available from the TYPO3
extension manager and at 
http://typo3.org/extensions/repository/view/sg_zfelib/1.1.513/. Users of 
the extension are advised to update the extension as soon as possible.

Additional Note: As the mentioned extension is a library which provides
functionality for other extensions, all extensions that depend on
sg_zfelib (version 1.1.512 and below) will inherit the vulnerability of
sg_zfelib.

Extensions based on sg_zfelib are for example: sg_newsplus, sg_address,
sg_avmedia, sg_event, sg_genealogy, sg_glossary, sg_newsletter,
sg_prodprom, sg_smallads, sg_userdata, sg_filelist, sg_dictionary.

This is not a complete list. More extensions using sg_zfelib may exist
that are for example not listed on TER.

General advice: Follow the recommendations that are given in the TYPO3
Security Cookbook. Please subscribe to the typo3-announce mailing list
to receive future Security Bulletins via E-mail.

Credits: Credits go to Philipp Rocholl and Wassim Amouri, who discovered
and reported the issues. Furthermore the TYPO3 Security Team wishes to
thank the extension author Stefan Geith for fixing the extension.


_______________________________________________________________________

TYPO3 Security Bulletin TYPO3-20080527-1: Cross Site Scripting 
vulnerability in extension "KJ: Image Lightbox v2" (kj_imagelightbox2)

Component Type: Third party extension. This extension is not part of the
TYPO3 default installation.

Affected Versions: Version 1.4.2 and below, possibly also all versions
of obsolete predecessor extension kj_imagelightbox

Vulnerability Type: Cross Site Scripting

Severity: Medium

Problem Description: Failing to filter user input the extension is
susceptible to Cross Site Scripting (XSS) making it possible to execute
arbitrary JavaScript.

Solution: An updated version 1.4.3 is available from the TYPO3 extension
manager and at 
http://typo3.org/extensions/repository/view/kj_imagelightbox2/1.4.3/. 
Users of the extension are advised to update the extension as soon as
possible.

Users of the extension kj_imagelightbox, which is the predecessor of
kj_imagelightbox2, should switch to kj_imagelightbox2 1.4.3 too. The
predecessor might contain the same security issue, but is no longer part
of TER because the extension author decided to not maintain it any
longer.

General advice: Follow the recommendations that are given in the TYPO3
Security Cookbook. Please subscribe to the typo3-announce mailing list
to receive future Security Bulletins via E-mail.

Credits: Credits go to Michael Raberger, who discovered the issues.
Furthermore the TYPO3 Security Team wishes to thank the extension author
Julian Kleinhans for fixing the issue.


======================================================================

           =========================================================
           Les serveurs de référence du CERT-Renater
           http://www.urec.fr/securite
           http://www.cru.fr/securite
           http://www.renater.fr
           =========================================================
           + CERT-RENATER          | tel : 01-53-94-20-44          +
           + 151 bd de l'Hopital   | fax : 01-53-94-20-41          +
           + 75013 Paris           | email: certsvp@renater.fr     +
           =========================================================