Vulnerabilities > CVE-2017-5361 - Unspecified vulnerability in Bestpractical Request Tracker

047910
CVSS 4.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
NONE
Availability impact
NONE
network
bestpractical
nessus

Summary

Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 does not use a constant-time comparison algorithm for secrets, which makes it easier for remote attackers to obtain sensitive user password information via a timing side-channel attack.

Vulnerable Configurations

Part Description Count
Application
Bestpractical
41

Nessus

  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_7A92E958520711E78D7C6805CA0B3D42.NASL
    descriptionBestPractical reports : Please reference CVE/URL list for details
    last seen2020-06-01
    modified2020-06-02
    plugin id100827
    published2017-06-16
    reporterThis script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100827
    titleFreeBSD : rt and dependent modules -- multiple security vulnerabilities (7a92e958-5207-11e7-8d7c-6805ca0b3d42)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the FreeBSD VuXML database :
    #
    # Copyright 2003-2018 Jacques Vidrine and contributors
    #
    # Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
    # HTML, PDF, PostScript, RTF and so forth) with or without modification,
    # are permitted provided that the following conditions are met:
    # 1. Redistributions of source code (VuXML) must retain the above
    #    copyright notice, this list of conditions and the following
    #    disclaimer as the first lines of this file unmodified.
    # 2. Redistributions in compiled form (transformed to other DTDs,
    #    published online in any format, converted to PDF, PostScript,
    #    RTF and other formats) must reproduce the above copyright
    #    notice, this list of conditions and the following disclaimer
    #    in the documentation and/or other materials provided with the
    #    distribution.
    # 
    # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
    # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
    # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
    # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
    # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
    # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
    # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
    # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
    # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
    # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
    # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(100827);
      script_version("3.4");
      script_cvs_date("Date: 2018/11/10 11:49:46");
    
      script_cve_id("CVE-2015-7686", "CVE-2016-6127", "CVE-2017-5361", "CVE-2017-5943", "CVE-2017-5944");
    
      script_name(english:"FreeBSD : rt and dependent modules -- multiple security vulnerabilities (7a92e958-5207-11e7-8d7c-6805ca0b3d42)");
      script_summary(english:"Checks for updated packages in pkg_info output");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote FreeBSD host is missing one or more security-related
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "BestPractical reports :
    
    Please reference CVE/URL list for details"
      );
      # http://lists.bestpractical.com/pipermail/rt-announce/2017-June/000297.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?7d752cd9"
      );
      # https://vuxml.freebsd.org/freebsd/7a92e958-5207-11e7-8d7c-6805ca0b3d42.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?a45429d1"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:p5-RT-Authen-ExternalAuth");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:rt42");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:rt44");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/06/15");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/06/15");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/06/16");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"FreeBSD Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("freebsd_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
    if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (pkg_test(save_report:TRUE, pkg:"rt42>=4.2.0<4.2.13_1")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"rt44>=4.4.0<4.4.1_1")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"p5-RT-Authen-ExternalAuth>=0.9<0.27")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3882.NASL
    descriptionMultiple vulnerabilities have been discovered in Request Tracker, an extensible trouble-ticket tracking system. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2016-6127 It was discovered that Request Tracker is vulnerable to a cross-site scripting (XSS) attack if an attacker uploads a malicious file with a certain content type. Installations which use the AlwaysDownloadAttachments config setting are unaffected by this flaw. The applied fix addresses all existant and future uploaded attachments. - CVE-2017-5361 It was discovered that Request Tracker is vulnerable to timing side-channel attacks for user passwords. - CVE-2017-5943 It was discovered that Request Tracker is prone to an information leak of cross-site request forgery (CSRF) verification tokens if a user is tricked into visiting a specially crafted URL by an attacker. - CVE-2017-5944 It was discovered that Request Tracker is prone to a remote code execution vulnerability in the dashboard subscription interface. A privileged attacker can take advantage of this flaw through carefully-crafted saved search names to cause unexpected code to be executed. The applied fix addresses all existant and future saved searches. Additionally to the above mentioned CVEs, this update workarounds CVE-2015-7686 in Email::Address which could induce a denial of service of Request Tracker itself.
    last seen2020-06-01
    modified2020-06-02
    plugin id100818
    published2017-06-16
    reporterThis script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100818
    titleDebian DSA-3882-1 : request-tracker4 - security update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-3882. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(100818);
      script_version("3.8");
      script_cvs_date("Date: 2018/11/10 11:49:38");
    
      script_cve_id("CVE-2016-6127", "CVE-2017-5361", "CVE-2017-5943", "CVE-2017-5944");
      script_xref(name:"DSA", value:"3882");
    
      script_name(english:"Debian DSA-3882-1 : request-tracker4 - security update");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Multiple vulnerabilities have been discovered in Request Tracker, an
    extensible trouble-ticket tracking system. The Common Vulnerabilities
    and Exposures project identifies the following problems :
    
      - CVE-2016-6127
        It was discovered that Request Tracker is vulnerable to
        a cross-site scripting (XSS) attack if an attacker
        uploads a malicious file with a certain content type.
        Installations which use the AlwaysDownloadAttachments
        config setting are unaffected by this flaw. The applied
        fix addresses all existant and future uploaded
        attachments.
    
      - CVE-2017-5361
        It was discovered that Request Tracker is vulnerable to
        timing side-channel attacks for user passwords.
    
      - CVE-2017-5943
        It was discovered that Request Tracker is prone to an
        information leak of cross-site request forgery (CSRF)
        verification tokens if a user is tricked into visiting a
        specially crafted URL by an attacker.
    
      - CVE-2017-5944
        It was discovered that Request Tracker is prone to a
        remote code execution vulnerability in the dashboard
        subscription interface. A privileged attacker can take
        advantage of this flaw through carefully-crafted saved
        search names to cause unexpected code to be executed.
        The applied fix addresses all existant and future saved
        searches.
    
    Additionally to the above mentioned CVEs, this update workarounds
    CVE-2015-7686 in Email::Address which could induce a denial of service
    of Request Tracker itself."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-6127"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2017-5361"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2017-5943"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2017-5944"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2015-7686"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/jessie/request-tracker4"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.debian.org/security/2017/dsa-3882"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade the request-tracker4 packages.
    
    For the stable distribution (jessie), these problems have been fixed
    in version 4.2.8-3+deb8u2.
    
    For the upcoming stable distribution (stretch), these problems have
    been fixed in version 4.4.1-3+deb9u1."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:request-tracker4");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:8.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2017/06/15");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/06/16");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"8.0", prefix:"request-tracker4", reference:"4.2.8-3+deb8u2")) flag++;
    if (deb_check(release:"8.0", prefix:"rt4-apache2", reference:"4.2.8-3+deb8u2")) flag++;
    if (deb_check(release:"8.0", prefix:"rt4-clients", reference:"4.2.8-3+deb8u2")) flag++;
    if (deb_check(release:"8.0", prefix:"rt4-db-mysql", reference:"4.2.8-3+deb8u2")) flag++;
    if (deb_check(release:"8.0", prefix:"rt4-db-postgresql", reference:"4.2.8-3+deb8u2")) flag++;
    if (deb_check(release:"8.0", prefix:"rt4-db-sqlite", reference:"4.2.8-3+deb8u2")) flag++;
    if (deb_check(release:"8.0", prefix:"rt4-doc-html", reference:"4.2.8-3+deb8u2")) flag++;
    if (deb_check(release:"8.0", prefix:"rt4-fcgi", reference:"4.2.8-3+deb8u2")) flag++;
    if (deb_check(release:"8.0", prefix:"rt4-standalone", reference:"4.2.8-3+deb8u2")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3883.NASL
    descriptionIt was discovered that RT::Authen::ExternalAuth, an external authentication module for Request Tracker, is vulnerable to timing side-channel attacks for user passwords. Only ExternalAuth in DBI (database) mode is vulnerable.
    last seen2020-06-01
    modified2020-06-02
    plugin id100819
    published2017-06-16
    reporterThis script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100819
    titleDebian DSA-3883-1 : rt-authen-externalauth - security update
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-987.NASL
    descriptionMultiple vulnerabilities have been discovered in Request Tracker, an extensible trouble-ticket tracking system. The Common Vulnerabilities and Exposures project identifies the following problems : CVE-2016-6127 It was discovered that Request Tracker is vulnerable to a cross-site scripting (XSS) attack if an attacker uploads a malicious file with a certain content type. Installations which use the AlwaysDownloadAttachments config setting are unaffected by this flaw. The applied fix addresses all existant and future uploaded attachments. CVE-2017-5361 It was discovered that Request Tracker is vulnerable to timing side-channel attacks for user passwords. CVE-2017-5943 It was discovered that Request Tracker is prone to an information leak of cross-site request forgery (CSRF) verification tokens if a user is tricked into visiting a specially crafted URL by an attacker. CVE-2017-5944 It was discovered that Request Tracker is prone to a remote code execution vulnerability in the dashboard subscription interface. A privileged attacker can take advantage of this flaw through carefully-crafted saved search names to cause unexpected code to be executed. The applied fix addresses all existant and future saved searches. Additionally to the above mentioned CVEs, this update works around CVE-2015-7686 in Email::Address which could induce a denial of service of Request Tracker itself. For Debian 7
    last seen2020-03-17
    modified2017-06-16
    plugin id100817
    published2017-06-16
    reporterThis script is Copyright (C) 2017-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/100817
    titleDebian DLA-987-1 : request-tracker4 security update
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2017-2B7C896551.NASL
    descriptionSecurity fix for CVE-2016-6127 CVE-2017-5361 CVE-2017-5943 CVE-2017-5944 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2017-08-11
    plugin id102383
    published2017-08-11
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/102383
    titleFedora 24 : rt (2017-2b7c896551)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-988.NASL
    descriptionIt was discovered that RT::Authen::ExternalAuth, an external authentication module for Request Tracker, is vulnerable to timing side-channel attacks for user passwords. Only ExternalAuth in DBI (database) mode is vulnerable. For Debian 7
    last seen2020-03-17
    modified2017-06-19
    plugin id100848
    published2017-06-19
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100848
    titleDebian DLA-988-1 : rt-authen-externalauth security update
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2017-01CE69C6BF.NASL
    descriptionSecurity fix for CVE-2016-6127 CVE-2017-5361 CVE-2017-5943 CVE-2017-5944 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2017-08-04
    plugin id102182
    published2017-08-04
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/102182
    titleFedora 25 : rt (2017-01ce69c6bf)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2017-475AED1BD1.NASL
    descriptionSecurity fix for CVE-2016-6127 CVE-2017-5361 CVE-2017-5943 CVE-2017-5944 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2017-08-04
    plugin id102184
    published2017-08-04
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/102184
    titleFedora 26 : rt (2017-475aed1bd1)