Hi Leute,
ich habe jetzt erst über die Sicherheitslücken bei typo3 gelesen. Ich möchte natürlich auch sofort diese schliessen nur weiss ich nicht genau wie und wo ich damit anfange:
http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-002/
Kann mir da bitte jemand helfen.
Danke
Gruss
mongospliff schriebIch möchte natürlich auch sofort diese schliessen nur weiss ich nicht genau wie und wo ich damit anfange:
Das steht doch dort exakt beschrieben:
Solution:
You can choose one of the solutions below:
1) Update to the TYPO3 versions 4.0.12, 4.1.10 or 4.2.6, or
2) Use this shell script (md5 sum: 0cbd0aac72e624cb3dd6673a01f85320, documentation in file) to run accross your webservers in order to replace the affected lines, or
2) Apply one of the patches linked below (fitting to the version you're using), or
3) Edit the affected file class.tslib_fe.php following the instructions below.
In TYPO3 versions equal or greater than 4.0, the affected file is located in typo3/sysext/cms/tslib/class.tslib_fe.php.
In TYPO3 versions lower than 4.0, the affected file is located in tslib/class.tslib_fe.php and possibly symlinked to the aforementioned location, also in typo3/sysext/cms/tslib/class.tslib_fe.php
In the file, search for the line:
------------------------
} else die('jumpurl Secure: Calculated juHash, '.$calcJuHash.', did not match the submitted juHash.');
------------------------and replace it with:
------------------------
} else die('jumpurl Secure: Calculated juHash did not match the submitted juHash.');
------------------------Note: Version 3.3 and 3.5 of TYPO3 uses double-quotes, which means you have to search ".$calcJuHash." when doing manual replacing.