PT-2009-1004 · Typo3 · Typo3

Chris John Riley · Publicado 2009-01-22 · Atualizado 2024-02-14 · CVE-2009-0255

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TYPO3 versions 4.0.0 through 4.0.9 TYPO3 versions 4.1.0 through 4.1.7 TYPO3 versions 4.2.0 through 4.2.3

Description The issue allows attackers to compromise the confidentiality, integrity, and availability of protected information. It can be exploited remotely. The System extension Install tool in TYPO3 creates the encryption key with an insufficiently random seed, making it easier for attackers to crack the key.

Recommendations For versions 4.0.0 through 4.0.9, update to a version that generates encryption keys with a sufficiently random seed. For versions 4.1.0 through 4.1.7, update to a version that generates encryption keys with a sufficiently random seed. For versions 4.2.0 through 4.2.3, update to a version that generates encryption keys with a sufficiently random seed.

Exploit

Correção

Use of Insufficiently Random Values

Enumeração de Fraquezas

CWE-330

Identificadores relacionados

BDU:2015-01426

CVE-2009-0255

DSA-1711-1

Produtos afetados

Typo3

Referências · 15

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/typo3_sa_2009_001.rb · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0257 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-01426 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0256 · Nota de Segurança
• http://secunia.com/advisories/33679 · Aviso do Fabricante
• http://debian.org/security/2009/dsa-1711 · Aviso do Fabricante
• http://debian.org/security/dsa-1711 · Nota
• http://secunia.com/advisories/33617 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0258 · Nota de Segurança
• http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-001 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-0255 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48132 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0255 · Nota
• http://securityfocus.com/bid/33376 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0255 · Nota de Segurança