漏洞信息详情

Typo3 输入验证漏洞

• CNNVD编号：CNNVD-200901-303
• 危害等级： 高危
  
• CVE编号： CVE-2009-0258
• 漏洞类型： 输入验证
• 发布时间： 2009-01-22
• 威胁类型： 远程
• 更新时间： 2009-02-05
• 厂        商： typo3
• 漏洞来源：

漏洞简介

Typo3是开源内容管理系统(CMS)。

TYPO3 (4.0.0-4.0.9，4.1.0-4.1.7，4.2.0-4.2.3)搜索引擎系统扩展名允许远程攻击者借助一个特制的包含外壳元字符的文件名，执行任意指令。该漏洞未能被指令行分度器正确的处理。

漏洞公告

目前厂商已经发布了升级补丁以修复这个安全问题，补丁下载链接：

Debian Linux 4.0 amd64

Debian typo3-src-4.0_4.0.2+debian-7_all.deb

http://security.debian.org/pool/updates/main/t/typo3-src/typo3-src-4.0 _4.0.2+debian-7_all.deb

Debian typo3_4.0.2+debian-7_all.deb

http://security.debian.org/pool/updates/main/t/typo3-src/typo3_4.0.2+d ebian-7_all.deb

Debian Linux 4.0 ia-32

Debian typo3-src-4.0_4.0.2+debian-7_all.deb

http://security.debian.org/pool/updates/main/t/typo3-src/typo3-src-4.0 _4.0.2+debian-7_all.deb

Debian typo3_4.0.2+debian-7_all.deb

http://security.debian.org/pool/updates/main/t/typo3-src/typo3_4.0.2+d ebian-7_all.deb

Debian Linux 4.0 arm

Debian typo3-src-4.0_4.0.2+debian-7_all.deb

http://security.debian.org/pool/updates/main/t/typo3-src/typo3-src-4.0 _4.0.2+debian-7_all.deb

Debian typo3_4.0.2+debian-7_all.deb

http://security.debian.org/pool/updates/main/t/typo3-src/typo3_4.0.2+d ebian-7_all.deb

Debian Linux 4.0 hppa

Debian typo3-src-4.0_4.0.2+debian-7_all.deb

http://security.debian.org/pool/updates/main/t/typo3-src/typo3-src-4.0 _4.0.2+debian-7_all.deb

Debian typo3_4.0.2+debian-7_all.deb

http://security.debian.org/pool/updates/main/t/typo3-src/typo3_4.0.2+d ebian-7_all.deb

Debian Linux 4.0 sparc

Debian typo3-src-4.0_4.0.2+debian-7_all.deb

http://security.debian.org/pool/updates/main/t/typo3-src/typo3-src-4.0 _4.0.2+debian-7_all.deb

Debian typo3_4.0.2+debian-7_all.deb

http://security.debian.org/pool/updates/main/t/typo3-src/typo3_4.0.2+d ebian-7_all.deb

Debian Linux 4.0 s/390

Debian typo3-src-4.0_4.0.2+debian-7_all.deb

http://security.debian.org/pool/updates/main/t/typo3-src/typo3-src-4.0 _4.0.2+debian-7_all.deb

Debian typo3_4.0.2+debian-7_all.deb

http://security.debian.org/pool/updates/main/t/typo3-src/typo3_4.0.2+d ebian-7_all.deb

Debian Linux 4.0 powerpc

Debian typo3-src-4.0_4.0.2+debian-7_all.deb

http://security.debian.org/pool/updates/main/t/typo3-src/typo3-src-4.0 _4.0.2+debian-7_all.deb

Debian typo3_4.0.2+debian-7_all.deb

http://security.debian.org/pool/updates/main/t/typo3-src/typo3_4.0.2+d ebian-7_all.deb

Debian Linux 4.0 alpha

Debian typo3-src-4.0_4.0.2+debian-7_all.deb

http://security.debian.org/pool/updates/main/t/typo3-src/typo3-src-4.0 _4.0.2+debian-7_all.deb

Debian typo3_4.0.2+debian-7_all.deb

http://security.debian.org/pool/updates/main/t/typo3-src/typo3_4.0.2+d ebian-7_all.deb

Debian Linux 4.0 m68k

Debian typo3-src-4.0_4.0.2+debian-7_all.deb

http://security.debian.org/pool/updates/main/t/typo3-src/typo3-src-4.0 _4.0.2+debian-7_all.deb

Debian typo3_4.0.2+debian-7_all.deb

http://security.debian.org/pool/updates/main/t/typo3-src/typo3_4.0.2+d ebian-7_all.deb

Debian Linux 4.0

Debian typo3-src-4.0_4.0.2+debian-7_all.deb

http://security.debian.org/pool/updates/main/t/typo3-src/typo3-src-4.0 _4.0.2+debian-7_all.deb

Debian typo3_4.0.2+debian-7_all.deb

http://security.debian.org/pool/updates/main/t/typo3-src/typo3_4.0.2+d ebian-7_all.deb

Debian Linux 4.0 mipsel

Debian typo3-src-4.0_4.0.2+debian-7_all.deb

http://security.debian.org/pool/updates/main/t/typo3-src/typo3-src-4.0 _4.0.2+debian-7_all.deb

Debian typo3_4.0.2+debian-7_all.deb

http://security.debian.org/pool/updates/main/t/typo3-src/typo3_4.0.2+d ebian-7_all.deb

Debian Linux 4.0 ia-64

Debian typo3-src-4.0_4.0.2+debian-7_all.deb

http://security.debian.org/pool/updates/main/t/typo3-src/typo3-src-4.0 _4.0.2+debian-7_all.deb

Debian typo3_4.0.2+debian-7_all.deb

http://security.debian.org/pool/updates/main/t/typo3-src/typo3_4.0.2+d ebian-7_all.deb

Typo3 Typo3 4.0

Typo3 typo3_src+dummy-4.0.10.zip

http://prdownloads.sourceforge.net/typo3/typo3_src+dummy-4.0.10.zip?do wnload

Debian Linux 4.0 mips

Debian typo3-src-4.0_4.0.2+debian-7_all.deb

http://security.debian.org/pool/updates/main/t/typo3-src/typo3-src-4.0 _4.0.2+debian-7_all.deb

Debian typo3_4.0.2+debian-7_all.deb

http://security.debian.org/pool/updates/main/t/typo3-src/typo3_4.0.2+d ebian-7_all.deb

Typo3 Typo3 4.0.1

Typo3 typo3_src+dummy-4.0.10.zip

http:/

参考网址

来源: XF

名称: typo3-indexedsearch-command-execution(48138)

链接:http://xforce.iss.net/xforce/xfdb/48138

来源: BID

名称: 33376

链接:http://www.securityfocus.com/bid/33376

来源: MLIST

名称: [oss-security] 20090123 Re: CVE id request: typo3 SA-2009-001

链接:http://www.openwall.com/lists/oss-security/2009/01/23/4

来源: DEBIAN

名称: DSA-1711

链接:http://www.debian.org/security/2009/dsa-1711

来源: typo3.org

链接:http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-001/

来源: SECUNIA

名称: 33679

链接:http://secunia.com/advisories/33679

来源: SECUNIA

名称: 33617

链接:http://secunia.com/advisories/33617

受影响实体

• Typo3 Typo3:4.0.3  
• Typo3 Typo3:4.0.4  
• Typo3 Typo3:4.0.5  
• Typo3 Typo3:4.2.3  
• Typo3 Typo3:4.2.2  

补丁

暂无