Vulnerabilities > CVE-2012-6579 - Cryptographic Issues vulnerability in Bestpractical Request Tracker

047910
CVSS 6.4 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
bestpractical
CWE-310
nessus

Summary

Best Practical Solutions RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8, when GnuPG is enabled, allows remote attackers to configure encryption or signing for certain outbound e-mail, and possibly cause a denial of service (loss of e-mail readability), via an e-mail message to a queue's address.

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.

Nessus

  • NASL familyCGI abuses
    NASL idRT_3_8_15_OR_4_0_8.NASL
    descriptionAccording to its self-reported version number, the Best Practical Solutions Request Tracker (RT) running on the remote web server is version 3.x prior to 3.8.15 or version 4.x prior to 4.0.8. It is, therefore, potentially affected by the following vulnerabilities : - Users can inject arbitrary headers into outgoing email provided they have ModifySelf or AdminUser privileges. A remote attacker could exploit this to gain sensitive information or conduct phishing attacks. (CVE-2012-4730) - Any privileged user can create articles in any class due to the application failing to properly verify user access rights. (CVE-2012-4731) - A cross-site request forgery vulnerability exists that allows a remote attacker to hijack the authentication of users for requests that toggle ticket bookmarks. (CVE-2012-4732) - A warning bypass vulnerability exists that allows a
    last seen2020-06-01
    modified2020-06-02
    plugin id63065
    published2012-11-27
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/63065
    titleRequest Tracker 3.x < 3.8.15 / 4.x < 4.0.8 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(63065);
      script_version("1.10");
      script_cvs_date("Date: 2018/07/27 18:38:14");
    
      script_cve_id(
        "CVE-2012-4730",
        "CVE-2012-4731",
        "CVE-2012-4732",
        "CVE-2012-4734",
        "CVE-2012-4884",
        "CVE-2012-6578",
        "CVE-2012-6579",
        "CVE-2012-6580",
        "CVE-2012-6581"
      );
      script_bugtraq_id(56290, 56291);
    
      script_name(english:"Request Tracker 3.x < 3.8.15 / 4.x < 4.0.8 Multiple Vulnerabilities");
      script_summary(english:"Checks the version of Request Tracker.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote web server is running a Perl application that is affected
    by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "According to its self-reported version number, the Best Practical
    Solutions Request Tracker (RT) running on the remote web server is
    version 3.x prior to 3.8.15 or version 4.x prior to 4.0.8. It is,
    therefore, potentially affected by the following vulnerabilities :
    
      - Users can inject arbitrary headers into outgoing email
        provided they have ModifySelf or AdminUser privileges.
        A remote attacker could exploit this to gain sensitive
        information or conduct phishing attacks. (CVE-2012-4730)
    
      - Any privileged user can create articles in any class due
        to the application failing to properly verify user
        access rights. (CVE-2012-4731)
    
      - A cross-site request forgery vulnerability exists that
        allows a remote attacker to hijack the authentication
        of users for requests that toggle ticket bookmarks.
        (CVE-2012-4732)
    
      - A warning bypass vulnerability exists that allows a
        'confused deputy' attack during the handling of a
        specially crafted link. (CVE-2012-4734)
    
      - A vulnerability exists that allows an attacker to send
        arbitrary arguments to the command line for the GnuPG
        client (if GnuPG is enabled), which could result in the
        creation of arbitrary files with the permissions of the
        web server. (CVE-2012-4884)
    
      - Multiple vulnerabilities exist related to the improper
        signing or encryption of messages using GnuPG when GnuPG
        is enabled. (CVE-2012-6578, CVE-2012-6579,
        CVE-2012-6580, CVE-2012-6581)
    
    Note that Nessus has not tested for these issues but has instead
    relied only on the application's self-reported version number.");
      # http://blog.bestpractical.com/2012/10/security-vulnerabilities-in-rt.html
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2181f5d2");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Request Tracker 3.8.15 / 4.0.8 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/10/25");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/10/26");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/11/27");
    
      script_set_attribute(attribute:"potential_vulnerability", value:"true");
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:bestpractical:rt");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"CGI abuses");
    
      script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.");
    
      script_dependencies("rt_detect.nasl");
      script_exclude_keys("Settings/disable_cgi_scanning");
      script_require_keys("installed_sw/RT", "Settings/ParanoidReport");
      script_require_ports("Services/www", 80);
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("http.inc");
    include("install_func.inc");
    
    app = 'RT';
    get_install_count(app_name:app, exit_if_zero:TRUE);
    
    port = get_http_port(default:80);
    
    install = get_single_install(app_name:app, port:port, exit_if_unknown_ver:TRUE);
    
    if (report_paranoia < 2) audit(AUDIT_PARANOID);
    
    path    = install["path"];
    version = install["version"];
    install_loc = build_url(port:port, qs:path + "/");
    
    ver = split(version, sep:'.', keep:FALSE);
      for (i=0; i<max_index(ver); i++)
        ver[i] = int(ver[i]);
    
    # Versions 3.8.x / 4.0.x less than 3.8.15 / 4.0.8 are affected.
    if
    (
      ver[0] == 3 && ver[1] == 8 &&
      (
        (ver[2] < 15) ||
        (ver[2] == 15 && version =~ "(rc|pre|alpha|RC|test|CH|beta|preflight)")
      )
      ||
      (
        ver[0] == 4 && ver[1] == 0 &&
        (
          (ver[2] < 8) ||
          (ver[2] == 8 && version =~ "(rc|pre|alpha|RC|test|CH|beta|preflight)")
        )
      )
    )  
    {
      set_kb_item(name:'www/'+port+'/XSRF', value:TRUE);
      if (report_verbosity > 0)
      {
        report =
          '\n  URL               : ' +install_loc+
          '\n  Installed version : ' +version+
          '\n  Fixed version     : 3.8.15 / 4.0.8\n';
        security_warning(port:port, extra:report);
      }
      else security_warning(port);
    }
    else audit(AUDIT_WEB_APP_NOT_AFFECTED, app, install_loc, version);
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2012-17174.NASL
    description---------------------------------------------------------------------- ---------- ChangeLog : - Sun Oct 28 2012 Ralf Corsepius <corsepiu at fedoraproject.org> - 3.8.15-1 - Upstream update (RH BZ 870407, CVE-2012-4730, CVE-2012-4732, CVE-2012-4734, CVE-2012-4735, CVE-2012-4884). - Sat Oct 6 2012 Ralf Corsepius <corsepiu at fedoraproject.org> - 3.8.14-1 - Upstream update. - Sat Jun 2 2012 Ralf Corsepius <corsepiu at fedoraproject.org> - 3.8.13-1 - Upstream update. - Tue May 22 2012 Ralf Corsepius <corsepiu at fedoraproject.org> - 3.8.12-1 - Upstream update. - Address various CVEs (BZ 824082). Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2012-11-08
    plugin id62845
    published2012-11-08
    reporterThis script is Copyright (C) 2012-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/62845
    titleFedora 17 : rt3-3.8.15-1.fc17 (2012-17174)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_4B738D54242711E29817C8600054B392.NASL
    descriptionBestPractical report : All versions of RT are vulnerable to an email header injection attack. Users with ModifySelf or AdminUser can cause RT to add arbitrary headers or content to outgoing mail. Depending on the scrips that are configured, this may be be leveraged for information leakage or phishing. RT 4.0.0 and above and RTFM 2.0.0 and above contain a vulnerability due to lack of proper rights checking, allowing any privileged user to create Articles in any class. All versions of RT with cross-site-request forgery (CSRF) protection (RT 3.8.12 and above, RT 4.0.6 and above, and any instances running the security patches released 2012-05-22) contain a vulnerability which incorrectly allows though CSRF requests which toggle ticket bookmarks. All versions of RT are vulnerable to a confused deputy attack on the user. While not strictly a CSRF attack, users who are not logged in who are tricked into following a malicious link may, after supplying their credentials, be subject to an attack which leverages their credentials to modify arbitrary state. While users who were logged in would have observed the CSRF protection page, users who were not logged in receive no such warning due to the intervening login process. RT has been extended to notify users of pending actions during the login process. RT 3.8.0 and above are susceptible to a number of vulnerabilities concerning improper signing or encryption of messages using GnuPG; if GnuPG is not enabled, none of the following affect you.
    last seen2020-06-01
    modified2020-06-02
    plugin id62793
    published2012-11-02
    reporterThis script is Copyright (C) 2012-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/62793
    titleFreeBSD : RT -- Multiple Vulnerabilities (4b738d54-2427-11e2-9817-c8600054b392)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2012-17218.NASL
    description---------------------------------------------------------------------- ---------- ChangeLog : - Sun Oct 28 2012 Ralf Corsepius <corsepiu at fedoraproject.org> - 3.8.15-1 - Upstream update (RH BZ 870407, CVE-2012-4730, CVE-2012-4732, CVE-2012-4734, CVE-2012-4735, CVE-2012-4884). - Sat Oct 6 2012 Ralf Corsepius <corsepiu at fedoraproject.org> - 3.8.14-1 - Upstream update. - Sat Jun 2 2012 Ralf Corsepius <corsepiu at fedoraproject.org> - 3.8.13-1 - Upstream update. - Tue May 22 2012 Ralf Corsepius <corsepiu at fedoraproject.org> - 3.8.12-1 - Upstream update. - Address various CVEs (BZ 824082). - Thu Feb 2 2012 Ralf Corsepius <corsepiu at fedoraproject.org> - 3.8.11-7 - Fix shebangs. - Make testsuite files executable (enables rpm
    last seen2020-03-17
    modified2012-11-08
    plugin id62846
    published2012-11-08
    reporterThis script is Copyright (C) 2012-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/62846
    titleFedora 16 : rt3-3.8.15-1.fc16 (2012-17218)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-2567.NASL
    descriptionSeveral vulnerabilities were discovered in Request Tracker (RT), an issue tracking system. - CVE-2012-4730 Authenticated users can add arbitrary headers or content to mail generated by RT. - CVE-2012-4732 A CSRF vulnerability may allow attackers to toggle ticket bookmarks. - CVE-2012-4734 If users follow a crafted URI and log in to RT, they may trigger actions which would ordinarily blocked by the CSRF prevention logic. - CVE-2012-6578, CVE-2012-6579, CVE-2012-6580, CVE-2012-6581 Several different vulnerabilities in GnuPG processing allow attackers to cause RT to improperly sign outgoing email. - CVE-2012-4884 If GnuPG support is enabled, authenticated users can create arbitrary files as the web server user, which may enable arbitrary code execution. Please note that if you run request-tracker3.8 under the Apache web server, you must stop and start Apache manually. The
    last seen2020-03-17
    modified2012-10-29
    plugin id62722
    published2012-10-29
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/62722
    titleDebian DSA-2567-1 : request-tracker3.8 - several vulnerabilities
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2012-17143.NASL
    description---------------------------------------------------------------------- ---------- Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2012-11-08
    plugin id62844
    published2012-11-08
    reporterThis script is Copyright (C) 2012-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/62844
    titleFedora 18 : rt3-3.8.15-1.fc18 (2012-17143)