TYPO3 typo3/t3lib/thumbs.php Direct Request Path Disclosure

2006-01-19T06:17:35
ID OSVDB:22665
Type osvdb
Reporter Rodrigo Marcos(advisories@irmplc.com)
Modified 2006-01-19T06:17:35

Description

Vulnerability Description

TYPO3 contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a remote attacker direclty requests the 'typo3/t3lib/thumbs.php' script, which will result in a failure to access certain include files. This will disclose the software's installation path in an error message, resulting in a loss of confidentiality. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks.

Solution Description

Currently, there are no known workarounds or upgrades to correct this issue. However, TYPO3 has released a patch to address this vulnerability.

Short Description

TYPO3 contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a remote attacker direclty requests the 'typo3/t3lib/thumbs.php' script, which will result in a failure to access certain include files. This will disclose the software's installation path in an error message, resulting in a loss of confidentiality. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks.

Manual Testing Notes

http://[target]/typo3/t3lib/thumbs.php

References:

Vendor Specific News/Changelog Entry: http://bugs.typo3.org/view.php?id=2248 Secunia Advisory ID:18546 Related OSVDB ID: 22666 Related OSVDB ID: 22667 Other Advisory URL: http://www.irmplc.com/advisory015.htm Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-01/0343.html Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-01/0334.html Keyword: IRM Security Advisory No. 015 FrSIRT Advisory: ADV-2006-0269 CVE-2006-0327