Vulnerabilities > CVE-2009-4405 - Remote Security vulnerability in Trac

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
edgewall
nessus

Summary

Multiple unspecified vulnerabilities in Trac before 0.11.6 have unknown impact and attack vectors, possibly related to (1) "policy checks in report results when using alternate formats" or (2) a "check for the 'raw' role that is missing in docutils < 0.6."

Nessus

NASL familyFedora Local Security Checks
NASL idFEDORA_2009-12975.NASL
descriptionUpdate to new upstream release including security fixes. For complete information please see the bug. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen2020-06-01
modified2020-06-02
plugin id43373
published2009-12-22
reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/43373
titleFedora 12 : trac-0.11.6-1.fc12 (2009-12975)
code
#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory 2009-12975.
#

include("compat.inc");

if (description)
{
  script_id(43373);
  script_version("1.10");
  script_cvs_date("Date: 2019/08/02 13:32:29");

  script_cve_id("CVE-2009-4405");
  script_xref(name:"FEDORA", value:"2009-12975");

  script_name(english:"Fedora 12 : trac-0.11.6-1.fc12 (2009-12975)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Update to new upstream release including security fixes. For complete
information please see the bug.

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=542394"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2009-December/032978.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?5870f882"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected trac package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:trac");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:12");

  script_set_attribute(attribute:"patch_publication_date", value:"2009/12/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2009/12/22");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^12([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 12.x", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);

flag = 0;
if (rpm_check(release:"FC12", reference:"trac-0.11.6-1.fc12")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "trac");
}

Seebug

bulletinFamilyexploit
descriptionCVE(CAN) ID: CVE-2009-4405 Trac是用Python编写的基于Web的事件跟踪系统。 Trac在生成逗号分隔或制表符分隔的文本格式报表时没有正确地强制某些策略,用户无需必要的权限就可以从故障单中访问敏感信息。 Edgewall Software Trac &lt; 0.11.6 厂商补丁: Edgewall Software ----------------- 目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载: http://trac.edgewall.org/browser/tags/trac-0.11.6/RELEASE
idSSV:15143
last seen2017-11-19
modified2009-12-25
published2009-12-25
reporterRoot
titleTrac文本格式报表信息泄露漏洞