Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title Request Tracker security update
Informations
Name DSA-2220 First vendor Publication 2011-04-19
Vendor Debian Last vendor Modification 2011-04-19
Severity (Vendor) N/A Revision 1

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:S/C:P/I:P/A:P)
Cvss Base Score 6.5 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 8 Authentication Requires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

Several vulnerabilities were in Request Tracker, an issue tracking system.

CVE-2011-1685 If the external custom field feature is enabled, Request Tracker allows authenticated users to execute arbitrary code with the permissions of the web server, possible triggered by a cross-site request forgery attack. (External custom fields are disabled by default.)

CVE-2011-1686 Multiple SQL injection attacks allow authenticated users to obtain data from the database in an unauthorized way.

CVE-2011-1687 An information leak allows an authenticated privileged user to obtain sensitive information, such as encrypted passwords, via the search interface.

CVE-2011-1688 When running under certain web servers (such as Lighttpd), Request Tracker is vulnerable to a directory traversal attack, allowing attackers to read any files accessible to the web server. Request Tracker instances running under Apache or Nginx are not affected.

CVE-2011-1689 Request Tracker contains multiple cross-site scripting vulnerabilities.

CVE-2011-1690 Request Tracker enables attackers to redirect authentication credentials supplied by legitimate users to third-party servers.

For the oldstable distribution (lenny), these problems have been fixed in version 3.6.7-5+lenny6 of the request-tracker3.6 package.

For the stable distribution (squeeze), these problems have been fixed in version 3.8.8-7+squeeze1 of the request-tracker3.8 package.

For the testing distribution (wheezy) and the unstable distribution (sid), these problems have been fixed in version 3.8.10-1 of the request-tracker3.8 package.

We recommend that you upgrade your Request Tracker packages.

Original Source

Url : http://www.debian.org/security/2011/dsa-2220

CWE : Common Weakness Enumeration

% Id Name
17 % CWE-352 Cross-Site Request Forgery (CSRF) (CWE/SANS Top 25)
17 % CWE-255 Credentials Management
17 % CWE-200 Information Exposure
17 % CWE-89 Improper Sanitization of Special Elements used in an SQL Command ('SQL Injection') (CWE/SANS Top 25)
17 % CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)
17 % CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:12831
 
Oval ID: oval:org.mitre.oval:def:12831
Title: DSA-2220-1 request-tracker3.6, request-tracker3.8 -- several
Description: Several vulnerabilities were in Request Tracker, an issue tracking system. CVE-2011-1685 If the external custom field feature is enabled, Request Tracker allows authenticated users to execute arbitrary code with the permissions of the web server, possible triggered by a cross-site request forgery attack. CVE-2011-1686 Multiple SQL injection attacks allow authenticated users to obtain data from the database in an unauthorised way. CVE-2011-1687 An information leak allows an authenticated privileged user to obtain sensitive information, such as encrypted passwords, via the search interface. CVE-2011-1688 When running under certain web servers, Request Tracker is vulnerable to a directory traversal attack, allowing attackers to read any files accessible to the web server. Request Tracker instances running under Apache or Nginx are not affected. CVE-2011-1689 Request Tracker contains multiple cross-site scripting vulnerabilities. CVE-2011-1690 Request Tracker enables attackers to redirect authentication credentials supplied by legitimate users to third-party servers.
Family: unix Class: patch
Reference(s): DSA-2220-1
CVE-2011-1685
CVE-2011-1686
CVE-2011-1687
CVE-2011-1688
CVE-2011-1689
CVE-2011-1690
 Version: 5
Platform(s): Debian GNU/Linux 5.0
Debian GNU/Linux 6.0
Debian GNU/kFreeBSD 6.0
 Product(s): request-tracker3.6, request-tracker3.8
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 79

OpenVAS Exploits

Date Description
2011-05-12 Name : FreeBSD Ports: rt36
File : nvt/freebsd_rt36.nasl
2011-05-09 Name : RT (Request Tracker) Cross Site Request Forgery Vulnerability
File : nvt/secpod_rt_csrf_vuln.nasl
2011-05-09 Name : RT (Request Tracker) Search Interface Information Disclosure Vulnerability
File : nvt/secpod_rt_search_info_disclosure_vuln.nasl
2011-05-09 Name : RT (Request Tracker) Unspecified Directory Traversal Vulnerability
File : nvt/secpod_rt_unspecified_dir_traversal_vuln.nasl
2011-05-09 Name : RT (Request Tracker) Unspecified Multiple Vulnerabilities
File : nvt/secpod_rt_unspecified_mult_vuln.nasl
2011-05-09 Name : RT (Request Tracker) Unspecified Security Bypass Vulnerability
File : nvt/secpod_rt_unspecified_sec_bypass_vuln.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
74798 RT Unspecified Authentication Credentials Disclosure
74797 RT Multiple Unspecified XSS
74796 RT Unspecified Traversal Arbitrary File Access
74795 RT Search Interface Encrypted Password Disclosure
74794 RT Multiple Unspecified SQL Injection
74793 RT External Custom Field Unspecified Remote Code Execution

Nessus® Vulnerability Scanner

Date Description
2011-04-20 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2220.nasl - Type : ACT_GATHER_INFO
2011-04-18 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_bf17150968dd11e0afe60003ba02bf30.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:30:06
  • Multiple Updates