Test ID:	1.3.6.1.4.1.25623.1.0.63297
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-1711-1)
Summary:	The remote host is missing an update for the Debian 'typo3-src' package(s) announced via the DSA-1711-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'typo3-src' package(s) announced via the DSA-1711-1 advisory. Vulnerability Insight: Several remotely exploitable vulnerabilities have been discovered in the TYPO3 web content management framework. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-0255 Chris John Riley discovered that the TYPO3-wide used encryption key is generated with an insufficiently random seed resulting in low entropy which makes it easier for attackers to crack this key. CVE-2009-0256 Marcus Krause discovered that TYPO3 is not invalidating a supplied session on authentication which allows an attacker to take over a victims session via a session fixation attack. CVE-2009-0257 Multiple cross-site scripting vulnerabilities allow remote attackers to inject arbitrary web script or HTML via various arguments and user supplied strings used in the indexed search system extension, adodb extension test scripts or the workspace module. CVE-2009-0258 Mads Olesen discovered a remote command injection vulnerability in the indexed search system extension which allows attackers to execute arbitrary code via a crafted file name which is passed unescaped to various system tools that extract file content for the indexing. Because of CVE-2009-0255, please make sure that besides installing this update, you also create a new encryption key after the installation. For the stable distribution (etch) these problems have been fixed in version 4.0.2+debian-7. For the unstable distribution (sid) these problems have been fixed in version 4.2.5-1. We recommend that you upgrade your TYPO3 packages. Affected Software/OS: 'typo3-src' package(s) on Debian 4. Solution: Please install the updated package(s). CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2009-0255 BugTraq ID: 33376 http://www.securityfocus.com/bid/33376 Debian Security Information: DSA-1711 (Google Search) http://www.debian.org/security/2009/dsa-1711 http://secunia.com/advisories/33617 http://secunia.com/advisories/33679 XForce ISS Database: typo3-installtool-weak-security(48132) https://exchange.xforce.ibmcloud.com/vulnerabilities/48132 Common Vulnerability Exposure (CVE) ID: CVE-2009-0256 XForce ISS Database: typo3-library-session-hijacking(48133) https://exchange.xforce.ibmcloud.com/vulnerabilities/48133 Common Vulnerability Exposure (CVE) ID: CVE-2009-0257 XForce ISS Database: typo3-adodb-xss(48137) https://exchange.xforce.ibmcloud.com/vulnerabilities/48137 XForce ISS Database: typo3-indexedsearchengine-xss(48135) https://exchange.xforce.ibmcloud.com/vulnerabilities/48135 XForce ISS Database: typo3-workspace-xss(48136) https://exchange.xforce.ibmcloud.com/vulnerabilities/48136 Common Vulnerability Exposure (CVE) ID: CVE-2009-0258 http://www.openwall.com/lists/oss-security/2009/01/23/4 XForce ISS Database: typo3-indexedsearch-command-execution(48138) https://exchange.xforce.ibmcloud.com/vulnerabilities/48138
Copyright	Copyright (C) 2009 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.