PT-2009-1004 · Typo3 · Typo3

Chris John Riley · Published 2009-01-22 · Updated 2024-02-14 · CVE-2009-0255

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TYPO3 versions 4.0.0 through 4.0.9 TYPO3 versions 4.1.0 through 4.1.7 TYPO3 versions 4.2.0 through 4.2.3

Description The issue allows attackers to compromise the confidentiality, integrity, and availability of protected information. It can be exploited remotely. The System extension Install tool in TYPO3 creates the encryption key with an insufficiently random seed, making it easier for attackers to crack the key.

Recommendations For versions 4.0.0 through 4.0.9, update to a version that generates encryption keys with a sufficiently random seed. For versions 4.1.0 through 4.1.7, update to a version that generates encryption keys with a sufficiently random seed. For versions 4.2.0 through 4.2.3, update to a version that generates encryption keys with a sufficiently random seed.

Exploit

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

BDU:2015-01426

CVE-2009-0255

DSA-1711-1

Affected Products

Typo3

References · 15

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/typo3_sa_2009_001.rb · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0257 · Security Note
• https://bdu.fstec.ru/vul/2015-01426 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0256 · Security Note
• http://secunia.com/advisories/33679 · Vendor Advisory
• http://debian.org/security/2009/dsa-1711 · Vendor Advisory
• http://secunia.com/advisories/33617 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0258 · Security Note
• http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0255 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0255 · Security Note
• http://debian.org/security/dsa-1711 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48132 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0255 · Note
• http://securityfocus.com/bid/33376 · Note