==================================================================== CERT-Renater Note d'Information No. 2012/VULN15TYPO3 ____________________________________________________________________ DATE : 29/03/2012 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S) : Systems running TYPO3 third party extensions. ====================================================================== http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2012-005/ ______________________________________________________________________ TYPO3 Security Bulletin TYPO3-EXT-SA-2012-005: Several vulnerabilities in third party extensions Release Date: March 28, 2012 Please read first: This Collective Security Bulletin (CSB) is a listing of vulnerable extensions with neither significant download numbers, nor other special importance amongst the TYPO3 Community. The intention of CSBs is to reduce the workload of the TYPO3 Security Team and of the maintainers of extensions with vulnerabilities. Nevertheless, vulnerabilities in TYPO3 core or important extensions will still get the well-known single Security Bulletin each. Please read our buzz blog post, which has a detailed explanation on CSBs. All vulnerabilities affect third-party extensions. These extensions are not part of the TYPO3 default installation. Extension: WhoisLookup (fe_whois) Affected Versions: 0.0.2 and all versions below Vulnerability Type: Arbitrary Code Execution Severity: Critical Suggested CVSS v2.0: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C (What's that?) Solution: Versions of this extension that are known to be vulnerable will no longer be available for download from the TYPO3 Extension Repository. The extension author claimed he will not maintain the extension any more. Please uninstall and delete the extension folder from your installation. Credits: Credits go to Security Team Member Franz G. Jahn who discovered and reported this issue. Extension: Display CSV / Excel files or database tables (cag_tables) Affected Version: 3.0.2 and all versions below Vulnerability Type: SQL Injection, File Disclosure, Cross-Site Scripting Severity: Critical Suggested CVSS v2.0: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C (What's that?) Solution: An update (version 3.0.3) is available from the TYPO3 extension manager and at http://typo3.org/extensions/repository/view/cag_tables/3.0.3/. Note: At the time of writing, the most recent version of Display CSV / Excel files or database tables is version 3.1.0 which is available at http://typo3.org/extensions/repository/view/cag_tables/3.1.0/. Credits: Credits go to Frederic Gaus who discovered and reported this issue. Extension: Useful informations in reports module (additional_reports) Affected Versions: 2.4.3 and all versions below Vulnerability Type: File Disclosure Severity: Critical Suggested CVSS v2.0: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C (What's that?) Solution: An update (version 2.4.4) is available from the TYPO3 extension manager and at http://typo3.org/extensions/repository/view/additional_reports/2.4.4/. Note: At the time of writing, the most recent version of Useful informations in reports module is version 2.4.6 which is available at http://typo3.org/extensions/repository/view/additional_reports/2.4.6/. Credits: Credits go to Security Team Member Georg Ringer who discovered and reported this issue. Extension: General data display (general_data_display) Affected Versions: 1.4.2 and all versions below Vulnerability Type: Cross-Site Scripting, SQL Injection Severity: Critical Suggested CVSS v2.0: AV:N/AC:L/Au:N/C:C/I:N/A:N/E:U/RL:OF/RC:C (What's that?) Solution: An update (version 1.4.3) is available from the TYPO3 extension manager and at http://typo3.org/extensions/repository/view/general_data_display/1.4.3/. Credits: Credits go to Security Team Member Helmut Hummel who discovered and reported the SQL Injection vulnerability. Extension: Realty Manager (realty) Affected Versions: 0.5.2 and all versions below Vulnerability Type: Unserialize vulnerability Severity: Critical Suggested CVSS v2.0: AV:N/AC:M/Au:N/C:C/I:N/A:N/E:U/RL:OF/RC:C (What's that?) Solution: An update (version 0.5.3) is available from the TYPO3 extension manager and at http://typo3.org/extensions/repository/view/realty/0.5.3/. Credits: Credits go to the extension author Oliver Klee who discovered and reported the issue. Extension: FEUser->BELogin (dkd_feuser_belogin) Affected Versions: 1.2.8 and all versions below Vulnerability Type: SQL Injection Severity: Critical Suggested CVSS v2.0: AV:N/AC:M/Au:N/C:C/I:N/A:N/E:U/RL:OF/RC:C (What's that?) Solution: An update (version 1.2.9) is available from the TYPO3 extension manager and at http://typo3.org/extensions/repository/view/dkd_feuser_belogin/1.2.9/. Credits: Credits go to Markus Hausamman who discovered and reported the issue. Extension: TCFacebook Connect (tc_fbconnect) Affected Versions: 0.0.1 Vulnerability Type: Authentication bypass Severity: Medium Suggested CVSS v2.0: AV:N/AC:H/Au:N/C:C/I:P/A:N/E:U/RL:OF/RC:C (What's that?) Solution: An update (version 0.0.2) is available from the TYPO3 extension manager and at http://typo3.org/extensions/repository/view/tc_fbconnect/0.0.2/. Note: The extension provides an update script (available as extension function through extension manager) which will randomize user passwords of accounts with a facebook ID assigned. Credits: Credits go to Security Team Member Franz G. Jahn who discovered and reported this issue. Extension: Easy Login and Register with OpenID (FE) (dix_easylogin) Affected Versions: 0.2.5 and all version below Vulnerability Type: Authentication bypass Severity: Medium Suggested CVSS v2.0: AV:N/AC:H/Au:N/C:C/I:P/A:N/E:U/RL:OF/RC:C (What's that?) Solution: An update (version 0.2.6) is available from the TYPO3 extension manager and at http://typo3.org/extensions/repository/view/dix_easylogin/0.2.6/. Note: At the time of writing, the most recent version of Easy Login and Register with OpenID (FE) is version 0.2.7 which is available at http://typo3.org/extensions/repository/view/dix_easylogin/0.2.7/. Credits: Credits go to Security Team Member Franz G. Jahn who discovered and reported this issue. Extension: Ajado Facebook Connect (ajado_facebook) Affected Versions: 0.2.1 and all version below Vulnerability Type: Authentication bypass Severity: Medium Suggested CVSS v2.0: AV:N/AC:H/Au:N/C:C/I:P/A:N/E:U/RL:OF/RC:C (What's that?) Solution: An update (version 0.2.2) is available from the TYPO3 extension manager and at http://typo3.org/extensions/repository/view/ajado_facebook/0.2.2/. Note: At the time of writing, the most recent version of Ajado Facebook Connect is version 0.3.2 which is available at http://typo3.org/extensions/repository/view/ajado_facebook/0.3.2/. Credits: Credits go to Security Team Member Franz G. Jahn who discovered and reported this issue. Extension: Facebook Connect to TYPO3 (facebook2t3) Affected Versions: 0.2.2 and all version below Vulnerability Type: Authentication bypass Severity: Medium Suggested CVSS v2.0: AV:N/AC:H/Au:N/C:C/I:P/A:N/E:U/RL:OF/RC:C (What's that?) Solution: An update (version 0.2.3) is available from the TYPO3 extension manager and at http://typo3.org/extensions/repository/view/facebook2t3/0.2.3/. Credits: Credits go to Security Team Member Franz G. Jahn who discovered and reported this issue. Extension: Social Login to TYPO3 (sociallogin2t3) Affected Versions: 0.2.0 and all version below Vulnerability Type: Authentication bypass Severity: Medium Suggested CVSS v2.0: AV:N/AC:H/Au:N/C:C/I:P/A:N/E:U/RL:OF/RC:C (What's that?) Solution: An update (version 0.2.1) is available from the TYPO3 extension manager and at http://typo3.org/extensions/repository/view/sociallogin2t3/0.2.1/. Credits: Credits go to Security Team Member Franz G. Jahn who discovered and reported this issue. Extension: Event Board (kb_eventboard) Affected Versions: 1.0.31 and all version below Vulnerability Type: SQL Injection Severity: Critical Suggested CVSS v2.0: AV:N/AC:M/Au:N/C:C/I:N/A:N/E:POC/RL:OF/RC:C (What's that?) Solution: An update (version 1.0.32) is available from the TYPO3 extension manager and at http://typo3.org/extensions/repository/view/kb_eventboard/1.0.32/. Credits: Credits go to Danny Affeldt who discovered and reported this issue. Extension: News system (news) Affected Versions: 1.3.1 and all version below Vulnerability Type: SQL Injection Severity: Critical Suggested CVSS v2.0: AV:N/AC:H/Au:N/C:C/I:N/A:N/E:POC/RL:OF/RC:C (What's that?) Solution: An update (version 1.3.2) is available from the TYPO3 extension manager and at http://typo3.org/extensions/repository/view/news/1.3.2/. Credits: Credits go to Sascha Egerer and extension maintainer Georg Ringer who discovered and reported this issue. General advice: Follow the recommendations that are given in the TYPO3 Security Guide. Please subscribe to the typo3-announce mailing list to receive future Security Bulletins via E-mail. ====================================================================== ========================================================= Serveur de référence du CERT-Renater https://services.renater.fr/ssi/ ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23 - 25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email: certsvp@renater.fr + =========================================================