Release Date: March 28, 2012
Please read first: This Collective Security Bulletin (CSB) is a listing of vulnerable extensions with neither significant download numbers, nor other special importance amongst the TYPO3 Community. The intention of CSBs is to reduce the workload of the TYPO3 Security Team and of the maintainers of extensions with vulnerabilities. Nevertheless, vulnerabilities in TYPO3 core or important extensions will still get the well-known single Security Bulletin each.
Please read our buzz blog post, which has a detailed explanation on CSBs.
All vulnerabilities affect third-party extensions. These extensions are not part of the TYPO3 default installation.
Extension: WhoisLookup (fe_whois)
Affected Versions: 0.0.2 and all versions below
Vulnerability Type: Arbitrary Code Execution
Severity: Critical
Suggested CVSS v2.0: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C (What's that?)
Solution: Versions of this extension that are known to be vulnerable will no longer be available for download from the TYPO3 Extension Repository. The extension author claimed he will not maintain the extension any more. Please uninstall and delete the extension folder from your installation.
Credits: Credits go to Security Team Member Franz G. Jahn who discovered and reported this issue.
Extension: Display CSV / Excel files or database tables (cag_tables)
Affected Version: 3.0.2 and all versions below
Vulnerability Type: SQL Injection, File Disclosure, Cross-Site Scripting
Severity: Critical
Suggested CVSS v2.0: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C (What's that?)
Solution: An update (version 3.0.3) is available from the TYPO3 extension manager and at http://typo3.org/extensions/repository/view/cag_tables/3.0.3/.
Note: At the time of writing, the most recent version of Display CSV / Excel files or database tables is version 3.1.0 which is available at http://typo3.org/extensions/repository/view/cag_tables/3.1.0/.
Credits: Credits go to Frederic Gaus who discovered and reported this issue.
Extension: Useful informations in reports module (additional_reports)
Affected Versions: 2.4.3 and all versions below
Vulnerability Type: File Disclosure
Severity: Critical
Suggested CVSS v2.0: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C (What's that?)
Solution: An update (version 2.4.4) is available from the TYPO3 extension manager and at http://typo3.org/extensions/repository/view/additional_reports/2.4.4/.
Note: At the time of writing, the most recent version of Useful informations in reports module is version 2.4.6 which is available at http://typo3.org/extensions/repository/view/additional_reports/2.4.6/.
Credits: Credits go to Security Team Member Georg Ringer who discovered and reported this issue.
Extension: General data display (general_data_display)
Affected Versions: 1.4.2 and all versions below
Vulnerability Type: Cross-Site Scripting, SQL Injection
Severity: Critical
Suggested CVSS v2.0: AV:N/AC:L/Au:N/C:C/I:N/A:N/E:U/RL:OF/RC:C (What's that?)
Solution: An update (version 1.4.3) is available from the TYPO3 extension manager and at http://typo3.org/extensions/repository/view/general_data_display/1.4.3/.
Credits: Credits go to Security Team Member Helmut Hummel who discovered and reported the SQL Injection vulnerability.
Extension: Realty Manager (realty)
Affected Versions: 0.5.2 and all versions below
Vulnerability Type: Unserialize vulnerability
Severity: Critical
Suggested CVSS v2.0: AV:N/AC:M/Au:N/C:C/I:N/A:N/E:U/RL:OF/RC:C (What's that?)
Solution: An update (version 0.5.3) is available from the TYPO3 extension manager and at http://typo3.org/extensions/repository/view/realty/0.5.3/.
Credits: Credits go to the extension author Oliver Klee who discovered and reported the issue.
Extension: FEUser->BELogin (dkd_feuser_belogin)
Affected Versions: 1.2.8 and all versions below
Vulnerability Type: SQL Injection
Severity: Critical
Suggested CVSS v2.0: AV:N/AC:M/Au:N/C:C/I:N/A:N/E:U/RL:OF/RC:C (What's that?)
Solution: An update (version 1.2.9) is available from the TYPO3 extension manager and at http://typo3.org/extensions/repository/view/dkd_feuser_belogin/1.2.9/.
Credits: Credits go to Markus Hausammann who discovered and reported the issue.
Extension: TCFacebook Connect (tc_fbconnect)
Affected Versions: 0.0.1
Vulnerability Type: Authentication bypass
Severity: Medium
Suggested CVSS v2.0: AV:N/AC:H/Au:N/C:C/I:P/A:N/E:U/RL:OF/RC:C (What's that?)
Solution: An update (version 0.0.2) is available from the TYPO3 extension manager and at http://typo3.org/extensions/repository/view/tc_fbconnect/0.0.2/.
Note: The extension provides an update script (available as extension function through extension manager) which will randomize user passwords of accounts with a facebook ID assigned.
Credits: Credits go to Security Team Member Franz G. Jahn who discovered and reported this issue.
Extension: Easy Login and Register with OpenID (FE) (dix_easylogin)
Affected Versions: 0.2.5 and all version below
Vulnerability Type: Authentication bypass
Severity: Medium
Suggested CVSS v2.0: AV:N/AC:H/Au:N/C:C/I:P/A:N/E:U/RL:OF/RC:C (What's that?)
Solution: An update (version 0.2.6) is available from the TYPO3 extension manager and at http://typo3.org/extensions/repository/view/dix_easylogin/0.2.6/.
Note: At the time of writing, the most recent version of Easy Login and Register with OpenID (FE) is version 0.2.7 which is available at http://typo3.org/extensions/repository/view/dix_easylogin/0.2.7/.
Credits: Credits go to Security Team Member Franz G. Jahn who discovered and reported this issue.
Extension: Ajado Facebook Connect (ajado_facebook)
Affected Versions: 0.2.1 and all version below
Vulnerability Type: Authentication bypass
Severity: Medium
Suggested CVSS v2.0: AV:N/AC:H/Au:N/C:C/I:P/A:N/E:U/RL:OF/RC:C (What's that?)
Solution: An update (version 0.2.2) is available from the TYPO3 extension manager and at http://typo3.org/extensions/repository/view/ajado_facebook/0.2.2/.
Note: At the time of writing, the most recent version of Ajado Facebook Connect is version 0.3.2 which is available at http://typo3.org/extensions/repository/view/ajado_facebook/0.3.2/.
Credits: Credits go to Security Team Member Franz G. Jahn who discovered and reported this issue.
Extension: Facebook Connect to TYPO3 (facebook2t3)
Affected Versions: 0.2.2 and all version below
Vulnerability Type: Authentication bypass
Severity: Medium
Suggested CVSS v2.0: AV:N/AC:H/Au:N/C:C/I:P/A:N/E:U/RL:OF/RC:C (What's that?)
Solution: An update (version 0.2.3) is available from the TYPO3 extension manager and a thttp://typo3.org/extensions/repository/view/facebook2t3/0.2.3/.
Credits: Credits go to Security Team Member Franz G. Jahn who discovered and reported this issue.
Extension: Social Login to TYPO3 (sociallogin2t3)
Affected Versions: 0.2.0 and all version below
Vulnerability Type: Authentication bypass
Severity: Medium
Suggested CVSS v2.0: AV:N/AC:H/Au:N/C:C/I:P/A:N/E:U/RL:OF/RC:C (What's that?)
Solution: An update (version 0.2.1) is available from the TYPO3 extension manager and at http://typo3.org/extensions/repository/view/sociallogin2t3/0.2.1/.
Credits: Credits go to Security Team Member Franz G. Jahn who discovered and reported this issue.
Extension: Event Board (kb_eventboard)
Affected Versions: 1.0.31 and all version below
Vulnerability Type: SQL Injection
Severity: Critical
Suggested CVSS v2.0: AV:N/AC:M/Au:N/C:C/I:N/A:N/E:POC/RL:OF/RC:C (What's that?)
Solution: An update (version 1.0.32) is available from the TYPO3 extension manager and at http://typo3.org/extensions/repository/view/kb_eventboard/1.0.32/.
Credits: Credits go to Danny Affeldt who discovered and reported this issue.
Extension: News system (news)
Affected Versions: 1.3.1 and all version below
Vulnerability Type: SQL Injection
Severity: Critical
Suggested CVSS v2.0: AV:N/AC:H/Au:N/C:C/I:N/A:N/E:POC/RL:OF/RC:C (What's that?)
Solution: An update (version 1.3.2) is available from the TYPO3 extension manager and at http://typo3.org/extensions/repository/view/news/1.3.2/.
Credits: Credits go to Sascha Egerer and extension maintainer Georg Ringer who discovered and reported this issue.
General advice: Follow the recommendations that are given in the TYPO3 Security Guide. Please subscribe to the typo3-announce mailing list to receive future Security Bulletins via E-mail.