[Secure-testing-team] Bug#505325: typo3-src-4.2: Cross-Site Scripting (XSS) in sysext felogin

[Christian Welzel]

Package: typo3-src-4.2
Version: 4.2.0 4.2.1 4.2.2 
Severity: grave
Tags: security
Justification: user security hole

typo3 backend is vulnerable to a xss attack in the system extension
"felogin" which handles frontend user logins to restricted areas of
a webpage.

-- System Information:
Debian Release: lenny/sid
  APT prefers testing
  APT policy: (650, 'testing'), (600, 'unstable')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.26-1-amd64 (SMP w/2 CPU cores)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Versions of packages typo3-src-4.2 depends on:
ii  libapache2-mod-php5           5.2.6-5    server-side, HTML-embedded scripti
ii  libjs-prototype               1.6.0.2-4  JavaScript Framework for dynamic w
ii  php5-cgi                      5.2.6-5    server-side, HTML-embedded scripti
ii  php5-cli                      5.2.6-5    command-line interpreter for the p
ii  ttf-dejavu                    2.25-3     Metapackage to pull in ttf-dejavu-

Versions of packages typo3-src-4.2 recommends:
pn  catdoc                   <none>          (no description available)
ii  exim4                    4.69-9          metapackage to ease Exim MTA (v4) 
ii  exim4-daemon-light [mail 4.69-9          lightweight Exim MTA (v4) daemon
ii  ghostscript              8.62.dfsg.1-3.1 The GPL Ghostscript PostScript/PDF
ii  graphicsmagick           1.1.11-3.2      collection of image processing too
ii  mysql-server             5.0.51a-17      MySQL database server (metapackage
ii  mysql-server-5.0 [mysql- 5.0.51a-17      MySQL database server binaries
ii  php5-gd                  5.2.6-5         GD module for php5
ii  php5-mysql               5.2.6-5         MySQL module for php5
ii  php5-xcache              1.2.2-3         Fast, stable PHP opcode cacher
ii  poppler-utils [xpdf-util 0.8.7-1         PDF utilitites (based on libpopple
pn  typo3-dummy              <none>          (no description available)

Versions of packages typo3-src-4.2 suggests:
ii  logcheck                      1.2.68     mails anomalies in the system logf
ii  php5-curl                     5.2.6-5    CURL module for php5
pn  ppthtml                       <none>     (no description available)
pn  unrtf                         <none>     (no description available)
pn  xlhtml                        <none>     (no description available)

-- no debconf information