Veiligheidsissues in diverse TYPO3 extensies: upgrade aangeraden!
Er zijn in een aantal TYPO3 extensies veiligheidsissues aangetroffen. Hiervoor heeft het TYPO3 Security Team een Security Bulletin uitgebracht. Hieronder leest u deze bulletin.
Wij raden het aan om de aanbevelingen van het TYPO3 Security Team te volgen. Indien u een TYPO3 Service Overeenkomst heeft bij alterNET, dan wordt de aanbevelingen van het TYPO3 Security Team automatisch uitgevoerd. Heeft u geen TYPO3 Service Overeenkomst, of twijfelt u daarover, neemt u dan zo spoedig mogelijk contact op met ons via 078 635 1200 of support@alternet.nl.
===============================================
Multiple SQL Injection and Cross-Site Scripting vulnerabilities in extension "T3BLOG" (t3blog)
Release Date: February 1, 2010
Component Type: Third party extension. This extension is not a part of the TYPO3 default installation.
Affected Versions: Version 0.6.2 and all versions below
Vulnerability Type: Multiple SQL Injection and Cross–Site Scripting vulnerabilities
Severity: Critical
Problem Description: The TYPO3 extension t3blog fails to sanitize parameters provided by the user through HTML forms. Therefore both SQL Injection and Cross–Site Scripting are possible in Frontend and Backend.
Solution: An updated version 0.8.0 is available from the TYPO3 extension manager and at typo3.org/extensions/repository/view/t3blog/0.8.0/. Users of the extension are advised to update the extension as soon as possible.
Credits: Credits go to TYPO3 Security Team Member Marcus Krause who discovered and reported the issues and to TYPO3 Security Team Member Dmitry Dulepov who fixed the issues.
Extension: Event Manager (eventmanagement)
Affected Versions: 0.0.1
Vulnerability Type: SQL Injection
Severity: High
Solution: An update (version 0.0.2) is available from the TYPO3 extension manager and at typo3.org/extensions/repository/view/eventmanagement/0.0.2/.
Credits: Credits go to TYPO3 Security Team member Georg Ringer, who discovered and reported the issue.
Extension: Game Article DB (game_articledb)
Affected Versions: 0.3.0 and all versions below
Vulnerability Type: SQL Injection
Severity: High
Solution: Versions of this extension that are known to be vulnerable will no longer be available for download from the TYPO3 Extension Repository. At the time of writing, we don't know of a security update of the extension regarding the existing vulnerability, since we have been unable to get in contact with the author. For the time being please uninstall this extension and delete all files belonging to it from your TYPO3 installation.
Note: Should the author decide to reply to our request and provide a fixed version, the extension could return to the TYPO3 Extension Repository.
Credits: Credits go to Christian Seifert, who discovered and reported the issue.
Extension: Simple career (ml_career)
Affected Versions: 0.1.1
Vulnerability Type: Cross-Site Scripting and SQL Injection
Severity: High
Solution: An update (version 0.1.2) is available from the TYPO3 extension manager and at typo3.org/extensions/repository/view/ml_career/0.1.2/.
Credits: Credits go to Patrick Nussbaumer, who discovered and reported the issue.
Extension: Surprise Calendar (ml_surprisecalendar)
Affected Versions: 0.3.1 and all versions below
Vulnerability Type: SQL Injection
Severity: High
Solution: An update (version 0.3.2) is available from the TYPO3 extension manager and at typo3.org/extensions/repository/view/ml_surprisecalendar/0.3.2/.
Credits: Credits go to TYPO3 Security Team member Georg Ringer, who discovered and reported the issue.
Extension: Search Api Ajax Google (searchajaxgoogle)
Affected Versions: 0.0.2 and all versions below
Vulnerability Type: Cross-Site Scripting
Severity: Medium
Solution: Versions of this extension that are known to be vulnerable will no longer be available for download from the TYPO3 Extension Repository. The extension author failed in providing a security fix for the reported vulnerability in a decent amount of time. Please uninstall and delete the extension folder from your installation.
Note: Should the author decide to reply to our request and provide a fixed version, the extension could return to the TYPO3 Extension Repository.
Credits: Credits go to Michael Schwarz, who discovered the issue and Cornelius Illi, who reported the issue.
Extension: Download Manager (spr_downloadmanager)
Affected Versions: 3.0.0 and all versions below
Vulnerability Type: Information Disclosure
Severity: High
Solution: Versions of this extension that are known to be vulnerable will no longer be available for download from the TYPO3 Extension Repository. The author told us that he's no longer maintaining this extension. Please uninstall and delete all files belonging to it from your TYPO3 installation.
Credits: Credits go to TYPO3 Security Team member Georg Ringer, who discovered and reported the issue.
====================
Is een van deze extensies aanwezig op uw website? Dan is het raadzaam deze zo snel mogelijk aan te passen of te verwijderen conform de bovenstaande informatie. Indien u een TYPO3 Service Overeenkomst heeft bij alterNET, dan wordt deze upgrade automatisch uitgevoerd. Heeft u geen TYPO3 Service Overeenkomst, of twijfelt u daarover, neemt u dan zo spoedig mogelijk contact op met ons via 078 635 1200 of support@alternet.nl.
