[TYPO3-dev] TYPO3 Security Bulletin 20070221-1: Email header injection

[Lars Houmark]

Dear users of TYPO3,

A problem has been discovered where the internal form engine can be  
used for sending arbitrary mail headers, using it for purposes which  
it is not meant for.

==== Component Type ====
TYPO3 Core

==== Affected Versions ====
Below 4.0.5, 4.1beta, 4.1RC1

==== Vulnerability Type ====
Email header injection

==== Severity ====
low

==== Solution ====
Update to TYPO3 version 4.0.5 or later by downloading it at:
http://typo3.org/download/packages/

==== General advice ====
Follow the recommendations that are given in the TYPO3 Security  
Cookbook, which can be found on:
http://typo3.org/teams/security/

==== Credits ====
Credits go to Olivier Dobberkau, Andreas Otto, and Thorsten Kahler,  
who discovered and supplied a patch for this issue.

The just released version 4.0.5, contains a lot of other non-security  
related fixes, so an upgrade is highly recommended in any situation.

Regards,

Lars Houmark
TYPO3 security team