Session fixation vulnerability in html/Elements/SetupSessionCookie in Best Practical Solutions RT 3.0.0 through 3.6.9 and 3.8.x through 3.8.5 allows remote attackers to hijack web sessions by setting the session identifier via a manipulation that leverages a second web server within the same domain.

Mikal Gule discovered that request-tracker, an extensible trouble-ticket tracking system, is prone to an attack, where an attacker with access to the same domain can hijack a user's RT session.

- Fri Dec 4 2009 Ralf Corsepius <corsepiu at     fedoraproject.org> - 3.8.2-12

    - Add rt-3.8.2-rh-bz543962.diff (BZ #543962).

    - Tue Oct 13 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-11

    - Update rt-3.8.2-rh-bz526870.diff.

    - Mon Oct 12 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-10

    - Add rt-3.8.2-rh-bz526870.diff (BZ #526870).

    - Wed Jun 24 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-9

    - Add R: perl(Data::ICal), R:
      perl(Data::ICal::Entry::Event) (BZ #507965).

    - Fri Jun 19 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-8

    - Address BZ #506885 (BZ #506236).

    - Remove rt-3.4.1-I18N.diff.

    - Fri Apr 24 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-7

    - README.fedora.in: Add --dba root to rt-setup-database       (BZ #488621).

    - R: perl(XML::RSS) (BZ #496720).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fri Dec 4 2009 Ralf Corsepius <corsepiu at     fedoraproject.org> - 3.8.2-12

    - Add rt-3.8.2-rh-bz543962.diff (BZ #543962).

    - Tue Oct 13 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-11

    - Update rt-3.8.2-rh-bz526870.diff.

    - Mon Oct 12 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-10

    - Add rt-3.8.2-rh-bz526870.diff (BZ #526870).

    - Wed Jun 24 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-9

    - Add R: perl(Data::ICal), R:
      perl(Data::ICal::Entry::Event) (BZ #507965).

    - Fri Jun 19 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-8

    - Address BZ #506885 (BZ #506236).

    - Remove rt-3.4.1-I18N.diff.

    - Fri Apr 24 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-7

    - README.fedora.in: Add --dba root to rt-setup-database       (BZ #488621).

    - R: perl(XML::RSS) (BZ #496720).

    - Wed Feb 18 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-5

    - Add R: perl(Class::Accessor::Fast),       perl(Exception::Class::Base),       perl(HTML::Mason::Request),       perl(Net::Server::PreFork).

  - Thu Feb 5 2009 Ralf Corsepius <corsepiu at     fedoraproject.org> - 3.8.2-4

    - Stop filtering perl(Test::Email).

    - Add perl(:MODULE_COMPAT ...) to perl-RT-Test.

    - Sat Jan 24 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-3

    - Fix date in changelog entry.

    - Sat Jan 24 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-2

    - Filter out R: perl(Test::Email).

    - Add perl-RT-Test package.

    - Activate --with devel_mode.

    - Don't pass --enable/disable-devel-mode to configure.

    - Add Explicit check for devel-mode deps.

    - Fri Jan 23 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-1

    - Upstream update.

    - Preps to add a perl-RT-Test package.

    - Sun Nov 30 2008 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.1-2

    - Fix rt3-mailgate's %defattr(-,root,root,-).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fri Dec 4 2009 Ralf Corsepius <corsepiu at     fedoraproject.org> - 3.8.4-7

    - Add rt-3.8.4-rh-bz543962.diff (BZ #543962).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Secunia reports :

A vulnerability has been reported in RT, which can be exploited by malicious people to conduct session fixation attacks. The vulnerability is caused due to an error in the handling of sessions and can be exploited to hijack another user's session by tricking the user into logging in after following a specially crafted link.

The remote host is running RT:  Request Tracker, an enterprise-grade ticketing system.  The version detected is affected by a session fixation vulnerability.  An attacker, exploiting this flaw, could gain unauthorized access to the application.

ID	Name	Product	Family	Severity
44809	Debian DSA-1944-1 : request-tracker3.4 request-tracker3.6 - session hijack	Nessus	Debian Local Security Checks	medium
43118	Fedora 11 : rt3-3.8.2-12.fc11 (2009-12827)	Nessus	Fedora Local Security Checks	medium
43117	Fedora 10 : rt3-3.8.2-12.fc10 (2009-12817)	Nessus	Fedora Local Security Checks	medium
43116	Fedora 12 : rt3-3.8.4-7.fc12 (2009-12783)	Nessus	Fedora Local Security Checks	medium
43094	FreeBSD : rt -- Session fixation vulnerability (714c1406-e4cf-11de-883a-003048590f9e)	Nessus	FreeBSD Local Security Checks	medium
5248	RT: Request Tracker Session Fixation Vulnerability	Nessus Network Monitor	CGI	medium

Detections

Analytics

CVE-2009-3585

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium