Date: Tue, 22 Feb 2011 15:37:03 +0100 From: Jan Lieskovsky <jlieskov@...hat.com> To: "Steven M. Christey" <coley@...us.mitre.org> CC: oss-security <oss-security@...ts.openwall.com>, Shawn M Moore <sartak@...tpractical.com>, Thomas Sibley <trs@...tpractical.com>, Ralf Corsépius <rc040203@...enet.de> Subject: CVE Request -- rt3 -- two issues: 1) Improper management of form data resubmittion upon user log out 2) SQL queries information leak by user account transition Hello Josh, Steve, vendors, RT3 upstream has released latest v3.8.9 version:  http://lists.bestpractical.com/pipermail/rt-announce/2011-February/000186.html addressing three security flaws: 1) * Move to a SHA-256 based password hashing scheme This has already got CVE id of CVE-2011-0009: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0009 2) * Redirect users to their desired pages after login. This prevents possible back button attacks after a user logs out. Further issue details: A security flaw was found in the way the RT3 ticketing system handled resubmitting of form data after the user has logged out of the browser (but not closed it). A local attacker could use this flaw to access the user account of the victim (login without providing a password or obtain user credentials). References: [a] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=614575 [b] http://lists.bestpractical.com/pipermail/rt-announce/2011-February/000186.html Upstream bug report: [c] http://issues.bestpractical.com/Ticket/Display.html?id=15804 Upstream changeset: [d] https://github.com/bestpractical/rt/commit/917c211820590950f7eb0521f7f43b31aeed44c4 Thomas, could you please confirm [d] is the proper fix for 2) issue? Thank you. (* Redirect users to their desired pages after login.) 3) * Clone Scrip's TicketObj since we change the CurrentUser and it can leak information (Custom field values, etc) Further issue details: A security flaw was found in the way the RT3 ticketing system handled logging of SQL queries during performing of user account transition. A remote, authenticated RT3 user could use this flaw to obtain sensitive information. References: [i] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=614576 [ii] http://lists.bestpractical.com/pipermail/rt-announce/2011-February/000186.html Upstream changeset (needs confirmation from upstream if it's real fix for the issue yet): [iii] https://github.com/bestpractical/rt/commit/56e20b874e8d67ab93aa80c2c00155110a27e764 Shawn, could you please confirm [iii] is the proper fix for 3) issue? (* Clone Scrip's TicketObj since we change the CurrentUser and it can leak) If [iii] not being the correct one for 3) issue, could you point us to the right one? Thank you. Steve, once patches confirmed, could you allocate CVE ids for the 2), and 3) issues? Thanks && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.