Re: Re: CVE request: TYPO3-EXT-SA-2014-014 and TYPO3-EXT-SA-2014-015

[Marcus Krause <marcus () t3sec info>]

Dears,

some information for clarification:

----- Original Message -----
> > TYPO3-EXT-SA-2014-015
> > [...]
>
> Use CVE-2014-8328.
> [...]
> This is within the scope of CVE because TYPO3 has published a Security
> Bulletin indicating that it's a vulnerability from their perspective.
> [...]
> As always, a vendor is allowed to announce this type of previously
> default intentional behavior as a vulnerability; it's just somewhat
> unusual to do so.

TYPO3 CMS Core already provides such update check. This is either triggered
manually or automatically on regular bases (cron like).

This works by retrieving a complete dataset of available third-party plugins
and their versions from typo3.org infrastructure. Then a TYPO3 CMS installation
on its own determines whether an update is available. So the only information
is the request for such dataset file (exposing remote IP address).

An update check in an extension is unnecessary and not an expected behaviour;
especially when it reports additional environment data and communicates with 
third-party infrastructure.


Regards,
Marcus Krause.

-- 
Member TYPO3 Security Team