Mikal Gule discovered that request-tracker, an extensible trouble-ticket tracking system, is prone to an attack, where an attacker with access to the same domain can hijack a user's RT session.

The version of Best Practical Solutions Request Tracker (RT) running on the remote web server is affected by a session fixation vulnerability due to the application authenticating users without invalidating their existing session ID. A remote attacker can exploit this by tricking a user into logging in with a known session ID, allowing the attacker to hijack the user's session.

This version of RT is reportedly affected by a different session fixation vulnerability, though Nessus has not checked for it.

Mikal Gule 氏は、拡張可能なトラブルチケットトラッキングシステムである request-tracker が、同じドメインにアクセスできる攻撃者がユーザーの RT セッションをハイジャックする可能性がある攻撃に対して脆弱であることを発見しました。

リモートWebサーバーで実行されているBest Practical Solutions Request Tracker（RT）のバージョンは、既存のセッションIDを無効にすることなくユーザーを認証するアプリケーションが原因で、セッションフィクセーションの脆弱性の影響を受けます。リモート攻撃者が、これを悪用して、ユーザーを騙して既知のセッションIDでログインさせることで、ユーザーのセッションをハイジャックする可能性があります。

このRTのバージョンは、別のセッションフィクセーションの脆弱性の影響を受けることが報告されていますが、Nessusではそれを確認していません。

遠端 Web 伺服器上執行的 Best Practical Solutions Request Tracker (RT) 版本受到一個工作階段固定弱點影響，這是因為應用程式未驗證使用者現有的工作階段 ID 就對其進行驗證所致。遠端攻擊者可誘騙使用者以已知的工作階段 ID 登入，藉此惡意利用此弱點，進而允許攻擊者劫持使用者的工作階段。

據報此版本的 RT 受到一個不同的工作階段固定弱點影響，但 Nessus 尚未對此進行檢查。

- Fri Dec 4 2009 Ralf Corsepius <corsepiu at     fedoraproject.org> - 3.8.4-7

    - Add rt-3.8.4-rh-bz543962.diff (BZ #543962).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fri Dec 4 2009 Ralf Corsepius <corsepiu at     fedoraproject.org> - 3.8.2-12

    - Add rt-3.8.2-rh-bz543962.diff (BZ #543962).

    - Tue Oct 13 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-11

    - Update rt-3.8.2-rh-bz526870.diff.

    - Mon Oct 12 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-10

    - Add rt-3.8.2-rh-bz526870.diff (BZ #526870).

    - Wed Jun 24 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-9

    - Add R: perl(Data::ICal), R:
      perl(Data::ICal::Entry::Event) (BZ #507965).

    - Fri Jun 19 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-8

    - Address BZ #506885 (BZ #506236).

    - Remove rt-3.4.1-I18N.diff.

    - Fri Apr 24 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-7

    - README.fedora.in: Add --dba root to rt-setup-database       (BZ #488621).

    - R: perl(XML::RSS) (BZ #496720).

    - Wed Feb 18 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-5

    - Add R: perl(Class::Accessor::Fast),       perl(Exception::Class::Base),       perl(HTML::Mason::Request),       perl(Net::Server::PreFork).

  - Thu Feb 5 2009 Ralf Corsepius <corsepiu at     fedoraproject.org> - 3.8.2-4

    - Stop filtering perl(Test::Email).

    - Add perl(:MODULE_COMPAT ...) to perl-RT-Test.

    - Sat Jan 24 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-3

    - Fix date in changelog entry.

    - Sat Jan 24 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-2

    - Filter out R: perl(Test::Email).

    - Add perl-RT-Test package.

    - Activate --with devel_mode.

    - Don't pass --enable/disable-devel-mode to configure.

    - Add Explicit check for devel-mode deps.

    - Fri Jan 23 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-1

    - Upstream update.

    - Preps to add a perl-RT-Test package.

    - Sun Nov 30 2008 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.1-2

    - Fix rt3-mailgate's %defattr(-,root,root,-).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fri Dec 4 2009 Ralf Corsepius <corsepiu at     fedoraproject.org> - 3.8.2-12

    - Add rt-3.8.2-rh-bz543962.diff (BZ #543962).

    - Tue Oct 13 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-11

    - Update rt-3.8.2-rh-bz526870.diff.

    - Mon Oct 12 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-10

    - Add rt-3.8.2-rh-bz526870.diff (BZ #526870).

    - Wed Jun 24 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-9

    - Add R: perl(Data::ICal), R:
      perl(Data::ICal::Entry::Event) (BZ #507965).

    - Fri Jun 19 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-8

    - Address BZ #506885 (BZ #506236).

    - Remove rt-3.4.1-I18N.diff.

    - Fri Apr 24 2009 Ralf Corsepius <corsepiu at       fedoraproject.org> - 3.8.2-7

    - README.fedora.in: Add --dba root to rt-setup-database       (BZ #488621).

    - R: perl(XML::RSS) (BZ #496720).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running RT:  Request Tracker, an enterprise-grade ticketing system.  The version detected is affected by a session fixation vulnerability.  An attacker, exploiting this flaw, could gain unauthorized access to the application.

ID	名稱	產品	系列	已發布	已更新	嚴重性
44809	Debian DSA-1944-1 : request-tracker3.4 request-tracker3.6 - session hijack	Nessus	Debian Local Security Checks	2010/2/24	2021/1/4	medium
43006	Request Tracker Session Fixation Vulnerability	Nessus	CGI abuses	2009/12/4	2022/4/11	medium
44809	Debian DSA-1944-1：request-tracker3.4 request-tracker3.6 - セッションハイジャック	Nessus	Debian Local Security Checks	2010/2/24	2021/1/4	medium
43006	Request Trackerのセッション固定の脆弱性	Nessus	CGI abuses	2009/12/4	2022/4/11	medium
43006	Request Tracker 工作階段固定弱點	Nessus	CGI abuses	2009/12/4	2022/4/11	medium
43116	Fedora 12 : rt3-3.8.4-7.fc12 (2009-12783)	Nessus	Fedora Local Security Checks	2009/12/14	2021/1/11	medium
43117	Fedora 10 : rt3-3.8.2-12.fc10 (2009-12817)	Nessus	Fedora Local Security Checks	2009/12/14	2021/1/11	medium
43118	Fedora 11 : rt3-3.8.2-12.fc11 (2009-12827)	Nessus	Fedora Local Security Checks	2009/12/14	2021/1/11	medium
5248	RT: Request Tracker Session Fixation Vulnerability	Nessus Network Monitor	CGI	2009/12/1	2019/3/6	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

medium

medium