| Description: | Summary:
The remote host is missing an update to request-tracker3.8 announced via advisory DSA 2480-1.
This VT has been deprecated and merged into the VT 'Debian: Security Advisory (DSA-2480)' (OID: 1.3.6.1.4.1.25623.1.0.71359).
Vulnerability Insight:
Several vulnerabilities were discovered in Request Tracker, an issue
tracking system:
CVE-2011-2082
The vulnerable-passwords scripts introduced for CVE-2011-0009
failed to correct the password hashes of disabled users.
CVE-2011-2083
Several cross-site scripting issues have been discovered.
CVE-2011-2084
Password hashes could be disclosed by privileged users.
CVE-2011-2085
Several cross-site request forgery vulnerabilities have been
found. If this update breaks your setup, you can restore the old
behaviour by setting $RestrictReferrer to 0.
CVE-2011-4458
The code to support variable envelope return paths allowed the
execution of arbitrary code.
CVE-2011-4459
Disabled groups were not fully accounted as disabled.
CVE-2011-4460
SQL injection vulnerability, only exploitable by privileged users.
For the stable distribution (squeeze), this problem has been fixed in
version 3.8.8-7+squeeze2.
For the unstable distribution (sid), this problem has been fixed in
version 4.0.5-3.
Solution:
We recommend that you upgrade your request-tracker3.8 packages.
CVSS Score:
6.8
CVSS Vector:
AV:N/AC:M/Au:N/C:P/I:P/A:P
|
