PT-2009-1007 · Typo3 · Typo3

Steven M. Christey · Published 2009-01-22 · Updated 2022-05-02 · CVE-2009-0258

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TYPO3 versions 4.0.0 through 4.0.9 TYPO3 versions 4.1.0 through 4.1.7 TYPO3 versions 4.2.0 through 4.2.3

Description The issue allows remote attackers to execute arbitrary commands via a crafted filename containing shell metacharacters, which is not properly handled by the command-line indexer. Multiple vulnerabilities in the TYPO3 package may lead to a breach of confidentiality, integrity, and availability of protected information, and can be exploited remotely.

Recommendations For versions 4.0.0 through 4.0.9, update to a version outside of this range to mitigate the risk. For versions 4.1.0 through 4.1.7, update to a version outside of this range to mitigate the risk. For versions 4.2.0 through 4.2.3, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the command-line indexer to minimize the risk of exploitation.

Fix

RCE

OS Command Injection

Use of Insufficiently Random Values

Weakness Enumeration

CWE-78

CWE-20

CWE-330

Related Identifiers

BDU:2015-01426

CVE-2009-0258

DSA-1711-1

GHSA-74W6-WW7W-45J9

Affected Products

Typo3

References · 17

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0257 · Security Note
• https://bdu.fstec.ru/vul/2015-01426 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0256 · Security Note
• http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0258 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0258 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0255 · Security Note
• http://debian.org/security/2009/dsa-1711 · Vendor Advisory
• http://secunia.com/advisories/33617 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-74w6-ww7w-45j9 · Vendor Advisory
• http://debian.org/security/dsa-1711 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48138 · Note
• http://secunia.com/advisories/33679 · Note
• http://openwall.com/lists/oss-security/2009/01/23/4 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0258 · Note