The EditCSVAction function in cgi/actions.py in Roundup 1.2 before 1.2.1, 1.4 through 1.4.6, and possibly other versions does not properly check permissions, which allows remote authenticated users with edit or create privileges for a class to modify arbitrary items within that class, as demonstrated by editing all queries, modifying settings, and adding roles to users.

- Mon Mar 9 2009 Paul P. Komkoff Jr <i at stingr.net> -     1.4.6-4

    - security bug bz#489355

    - Wed Feb 25 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 1.4.6-3

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild

    - Sat Nov 29 2008 Ignacio Vazquez-Abrams       <ivazqueznet+rpm at gmail.com> - 1.4.6-2

    - Rebuild for Python 2.6

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that roundup, an issue tracker with a command-line, web and email interface, allows users to edit resources in unauthorized ways, including granting themselves admin rights.

This update introduces stricter access checks, actually enforcing the configured permissions and roles. This means that the configuration may need updating. In addition, user registration via the web interface has been disabled; use the program 'roundup-admin' from the command line instead.

- Mon Mar 9 2009 Paul P. Komkoff Jr <i at stingr.net> -     1.4.6-4

    - security bug bz#489355

    - Wed Feb 25 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 1.4.6-3

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild

    - Sat Nov 29 2008 Ignacio Vazquez-Abrams       <ivazqueznet+rpm at gmail.com> - 1.4.6-2

    - Rebuild for Python 2.6

    - Fri Oct 3 2008 Paul P. Komkoff Jr <i at stingr.net> -       1.4.6-1

    - new upstream version

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
36875	Fedora 10 : roundup-1.4.6-4.fc10 (2009-2583)	Nessus	Fedora Local Security Checks	medium
36134	Debian DSA-1754-1 : roundup - insufficient access checks	Nessus	Debian Local Security Checks	medium
35909	Fedora 9 : roundup-1.4.6-4.fc9 (2009-2591)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2009-2737

medium

Tenable Plugins

medium

medium

medium