DSA-2567-1 request-tracker3.8 -- several vulnerabilities

Debian Security Advisory

DSA-2567-1 request-tracker3.8 -- several vulnerabilities

Date Reported:

26 Oct 2012

Affected Packages:

request-tracker3.8

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2012-4730, CVE-2012-4732, CVE-2012-4734, CVE-2012-4884, CVE-2012-6578, CVE-2012-6579, CVE-2012-6580, CVE-2012-6581.

More information:

Several vulnerabilities were discovered in Request Tracker (RT), an issue tracking system.

• CVE-2012-4730

  Authenticated users can add arbitrary headers or content to mail generated by RT.

• CVE-2012-4732

  A CSRF vulnerability may allow attackers to toggle ticket bookmarks.

• CVE-2012-4734

  If users follow a crafted URI and log in to RT, they may trigger actions which would ordinarily blocked by the CSRF prevention logic.

• CVE-2012-6578, CVE-2012-6579, CVE-2012-6580, CVE-2012-6581

  Several different vulnerabilities in GnuPG processing allow attackers to cause RT to improperly sign outgoing email.

• CVE-2012-4884

  If GnuPG support is enabled, authenticated users can create arbitrary files as the web server user, which may enable arbitrary code execution.

Please note that if you run request-tracker3.8 under the Apache web server, you must stop and start Apache manually. The restart mechanism is not recommended, especially when using mod_perl.

For the stable distribution (squeeze), these problems have been fixed in version 3.8.8-7+squeeze6.

For the unstable distribution (sid), these problems have been fixed in version 4.0.7-2 of the request-tracker4 package.

We recommend that you upgrade your request-tracker3.8 packages.