Acqal's TYPO3 Clients Protected Within 8 Hours of Security Notice

By: Michael Cannon

Submitting your vote...

Rating: 1.0 of 5. 1 vote(s).
Click the rating bar to rate this item.

Within 8-hours of TYPO3 Security Bulletin TYPO3-SA-2009-002 being released, Acqal's team had their active client TYPO3 systems updated. Did your TYPO3 CMS provider do the same?

The security bulletin contained a critical fix to an 

Information Disclosure vulnerability in jumpUrl mechanism, used to track access on web pages and provided files, allows a remote attacker to read arbitrary files on a host.

The expected value of a mandatory hash secret, intended to invalidate such requests, is exposed to remote users allowing them to bypass access control by providing the correct value.

There's no authentication required to exploit this vulnerability. The vulnerability allows to read any file, the web server user account has access to.

If your TYPO3 provider hasn't updated your TYPO3 system yet, contact Acqal for immediate help. Don't let this critical issue go unchecked. Most systems are fixed in under 30 minutes of effort.