Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote authenticated users with ModifySelf or AdminUser privileges to inject arbitrary email headers and conduct phishing attacks or obtain sensitive information via unknown vectors.

According to its self-reported version number, the Best Practical Solutions Request Tracker (RT) running on the remote web server is version 3.x prior to 3.8.15 or version 4.x prior to 4.0.8. It is, therefore, potentially affected by the following vulnerabilities :

  - Users can inject arbitrary headers into outgoing email     provided they have ModifySelf or AdminUser privileges.
    A remote attacker could exploit this to gain sensitive     information or conduct phishing attacks. (CVE-2012-4730)

  - Any privileged user can create articles in any class due     to the application failing to properly verify user     access rights. (CVE-2012-4731)

  - A cross-site request forgery vulnerability exists that     allows a remote attacker to hijack the authentication     of users for requests that toggle ticket bookmarks.
    (CVE-2012-4732)

  - A warning bypass vulnerability exists that allows a     'confused deputy' attack during the handling of a     specially crafted link. (CVE-2012-4734)

  - A vulnerability exists that allows an attacker to send     arbitrary arguments to the command line for the GnuPG     client (if GnuPG is enabled), which could result in the     creation of arbitrary files with the permissions of the     web server. (CVE-2012-4884)

  - Multiple vulnerabilities exist related to the improper     signing or encryption of messages using GnuPG when GnuPG     is enabled. (CVE-2012-6578, CVE-2012-6579,     CVE-2012-6580, CVE-2012-6581)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

----------------------------------------------------------------------
---------- ChangeLog :

  - Sun Oct 28 2012 Ralf Corsepius <corsepiu at     fedoraproject.org> - 3.8.15-1

    - Upstream update (RH BZ 870407, CVE-2012-4730,       CVE-2012-4732, CVE-2012-4734, CVE-2012-4735,       CVE-2012-4884).

  - Sat Oct 6 2012 Ralf Corsepius <corsepiu at     fedoraproject.org> - 3.8.14-1

    - Upstream update.

    - Sat Jun 2 2012 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.13-1

    - Upstream update.

    - Tue May 22 2012 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.12-1

    - Upstream update.

    - Address various CVEs (BZ 824082).

    - Thu Feb 2 2012 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.11-7

    - Fix shebangs.

    - Make testsuite files executable (enables rpm's perl       module dep tracking).

    - Build *-tests, iff devel_mode was given.

    - Misc. specfile massaging.

    - Tue Jan 31 2012 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.11-6

    - Misc. specfile improvements.

    - Tue Jan 31 2012 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.11-5

    - Rewrite *-tests package (Don't use tests macros).

    - Mon Jan 30 2012 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.11-4

    - Rename rpmbuild option with_tests into with_runtests.

    - Add rt3-tests subpackage.

    - Add README.tests.

    - Remove removal of ${RT3_LIBDIR}/t (Fixed by upstream).

    - Rework R:/BR:.

    - Use %{__rm} instead of /bin/rm.

    - Misc minor spec file cleanup.

    - Wed Jan 18 2012 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.11-3

    - Fix typo in filter rules.

    - Add lexdir, manualdir, RT3_LEXDIR.

    - Mon Jan 16 2012 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.11-2

    - Remove redundant R: config(rt3), Remove P:
      config(rt3).

    - Rewrite filter rules.

    - Sun Jan 15 2012 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.11-1

    - Upstream update.

    - Tue Jan 10 2012 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.10-5

    - Fix broken dependency filtering having been added in
      *-4.

    - Spec file cleanup.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

----------------------------------------------------------------------
---------- ChangeLog :

  - Sun Oct 28 2012 Ralf Corsepius <corsepiu at     fedoraproject.org> - 3.8.15-1

    - Upstream update (RH BZ 870407, CVE-2012-4730,       CVE-2012-4732, CVE-2012-4734, CVE-2012-4735,       CVE-2012-4884).

  - Sat Oct 6 2012 Ralf Corsepius <corsepiu at     fedoraproject.org> - 3.8.14-1

    - Upstream update.

    - Sat Jun 2 2012 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.13-1

    - Upstream update.

    - Tue May 22 2012 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.12-1

    - Upstream update.

    - Address various CVEs (BZ 824082).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

----------------------------------------------------------------------
----------

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

BestPractical report :

All versions of RT are vulnerable to an email header injection attack.
Users with ModifySelf or AdminUser can cause RT to add arbitrary headers or content to outgoing mail. Depending on the scrips that are configured, this may be be leveraged for information leakage or phishing.

RT 4.0.0 and above and RTFM 2.0.0 and above contain a vulnerability due to lack of proper rights checking, allowing any privileged user to create Articles in any class.

All versions of RT with cross-site-request forgery (CSRF) protection (RT 3.8.12 and above, RT 4.0.6 and above, and any instances running the security patches released 2012-05-22) contain a vulnerability which incorrectly allows though CSRF requests which toggle ticket bookmarks.

All versions of RT are vulnerable to a confused deputy attack on the user. While not strictly a CSRF attack, users who are not logged in who are tricked into following a malicious link may, after supplying their credentials, be subject to an attack which leverages their credentials to modify arbitrary state. While users who were logged in would have observed the CSRF protection page, users who were not logged in receive no such warning due to the intervening login process. RT has been extended to notify users of pending actions during the login process.

RT 3.8.0 and above are susceptible to a number of vulnerabilities concerning improper signing or encryption of messages using GnuPG; if GnuPG is not enabled, none of the following affect you.

Several vulnerabilities were discovered in Request Tracker (RT), an issue tracking system.

  - CVE-2012-4730     Authenticated users can add arbitrary headers or content     to mail generated by RT. 

  - CVE-2012-4732     A CSRF vulnerability may allow attackers to toggle     ticket bookmarks.

  - CVE-2012-4734     If users follow a crafted URI and log in to RT, they may     trigger actions which would ordinarily blocked by the     CSRF prevention logic.

  - CVE-2012-6578, CVE-2012-6579, CVE-2012-6580,     CVE-2012-6581

    Several different vulnerabilities in GnuPG processing     allow attackers to cause RT to improperly sign outgoing     email.

  - CVE-2012-4884     If GnuPG support is enabled, authenticated users can     create arbitrary files as the web server user, which may     enable arbitrary code execution.

Please note that if you run request-tracker3.8 under the Apache web server, you must stop and start Apache manually. The 'restart' mechanism is not recommended, especially when using mod_perl.

ID	Name	Product	Family	Severity
63065	Request Tracker 3.x < 3.8.15 / 4.x < 4.0.8 Multiple Vulnerabilities	Nessus	CGI abuses	medium
62846	Fedora 16 : rt3-3.8.15-1.fc16 (2012-17218)	Nessus	Fedora Local Security Checks	medium
62845	Fedora 17 : rt3-3.8.15-1.fc17 (2012-17174)	Nessus	Fedora Local Security Checks	medium
62844	Fedora 18 : rt3-3.8.15-1.fc18 (2012-17143)	Nessus	Fedora Local Security Checks	medium
62793	FreeBSD : RT -- Multiple Vulnerabilities (4b738d54-2427-11e2-9817-c8600054b392)	Nessus	FreeBSD Local Security Checks	medium
62722	Debian DSA-2567-1 : request-tracker3.8 - several vulnerabilities	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2012-4730

high

Tenable Plugins

medium

medium

medium

medium

medium

medium