Session fixation vulnerability in html/Elements/SetupSessionCookie in Best Practical Solutions RT 3.0.0 through 3.6.9 and 3.8.x through 3.8.5 allows remote attackers to hijack web sessions by setting the session identifier via a manipulation that leverages "HTTP access to the RT server," a related issue to CVE-2009-3585.

Mikal Gule discovered that request-tracker, an extensible trouble-ticket tracking system, is prone to an attack, where an attacker with access to the same domain can hijack a user's RT session.

- Fri Dec 4 2009 Ralf Corsepius <corsepiu at     fedoraproject.org> - 3.8.2-12

    - Add rt-3.8.2-rh-bz543962.diff (BZ #543962).

    - Tue Oct 13 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-11

    - Update rt-3.8.2-rh-bz526870.diff.

    - Mon Oct 12 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-10

    - Add rt-3.8.2-rh-bz526870.diff (BZ #526870).

    - Wed Jun 24 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-9

    - Add R: perl(Data::ICal), R:
      perl(Data::ICal::Entry::Event) (BZ #507965).

    - Fri Jun 19 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-8

    - Address BZ #506885 (BZ #506236).

    - Remove rt-3.4.1-I18N.diff.

    - Fri Apr 24 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-7

    - README.fedora.in: Add --dba root to rt-setup-database       (BZ #488621).

    - R: perl(XML::RSS) (BZ #496720).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fri Dec 4 2009 Ralf Corsepius <corsepiu at     fedoraproject.org> - 3.8.2-12

    - Add rt-3.8.2-rh-bz543962.diff (BZ #543962).

    - Tue Oct 13 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-11

    - Update rt-3.8.2-rh-bz526870.diff.

    - Mon Oct 12 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-10

    - Add rt-3.8.2-rh-bz526870.diff (BZ #526870).

    - Wed Jun 24 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-9

    - Add R: perl(Data::ICal), R:
      perl(Data::ICal::Entry::Event) (BZ #507965).

    - Fri Jun 19 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-8

    - Address BZ #506885 (BZ #506236).

    - Remove rt-3.4.1-I18N.diff.

    - Fri Apr 24 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-7

    - README.fedora.in: Add --dba root to rt-setup-database       (BZ #488621).

    - R: perl(XML::RSS) (BZ #496720).

    - Wed Feb 18 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-5

    - Add R: perl(Class::Accessor::Fast),       perl(Exception::Class::Base),       perl(HTML::Mason::Request),       perl(Net::Server::PreFork).

  - Thu Feb 5 2009 Ralf Corsepius <corsepiu at     fedoraproject.org> - 3.8.2-4

    - Stop filtering perl(Test::Email).

    - Add perl(:MODULE_COMPAT ...) to perl-RT-Test.

    - Sat Jan 24 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-3

    - Fix date in changelog entry.

    - Sat Jan 24 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-2

    - Filter out R: perl(Test::Email).

    - Add perl-RT-Test package.

    - Activate --with devel_mode.

    - Don't pass --enable/disable-devel-mode to configure.

    - Add Explicit check for devel-mode deps.

    - Fri Jan 23 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-1

    - Upstream update.

    - Preps to add a perl-RT-Test package.

    - Sun Nov 30 2008 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.1-2

    - Fix rt3-mailgate's %defattr(-,root,root,-).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fri Dec 4 2009 Ralf Corsepius <corsepiu at     fedoraproject.org> - 3.8.4-7

    - Add rt-3.8.4-rh-bz543962.diff (BZ #543962).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Best Practical Solutions Request Tracker (RT) running on the remote web server is affected by a session fixation vulnerability due to the application authenticating users without invalidating their existing session ID. A remote attacker can exploit this by tricking a user into logging in with a known session ID, allowing the attacker to hijack the user's session.

This version of RT is reportedly affected by a different session fixation vulnerability, though Nessus has not checked for it.

The remote host is running RT:  Request Tracker, an enterprise-grade ticketing system.  The version detected is affected by a session fixation vulnerability.  An attacker, exploiting this flaw, could gain unauthorized access to the application.

ID	Name	Product	Family	Severity
44809	Debian DSA-1944-1 : request-tracker3.4 request-tracker3.6 - session hijack	Nessus	Debian Local Security Checks	medium
43118	Fedora 11 : rt3-3.8.2-12.fc11 (2009-12827)	Nessus	Fedora Local Security Checks	medium
43117	Fedora 10 : rt3-3.8.2-12.fc10 (2009-12817)	Nessus	Fedora Local Security Checks	medium
43116	Fedora 12 : rt3-3.8.4-7.fc12 (2009-12783)	Nessus	Fedora Local Security Checks	medium
43006	Request Tracker Session Fixation Vulnerability	Nessus	CGI abuses	medium
5248	RT: Request Tracker Session Fixation Vulnerability	Nessus Network Monitor	CGI	medium

Detections

Analytics

CVE-2009-4151

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium