Test ID:	1.3.6.1.4.1.25623.1.0.72616
Category:	FreeBSD Local Security Checks
Title:	FreeBSD Ports: rt40
Summary:	The remote host is missing an update to the system; as announced in the referenced advisory.
Description:	Summary: The remote host is missing an update to the system as announced in the referenced advisory. Vulnerability Insight: The following packages are affected: rt40 rt38 CVE-2012-4730 Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote authenticated users with ModifySelf or AdminUser privileges to inject arbitrary email headers and conduct phishing attacks or obtain sensitive information via unknown vectors. CVE-2012-4731 FAQ manager for Request Tracker (RTFM) before 2.4.5 does not properly check user rights, which allows remote authenticated users to create arbitrary articles in arbitrary classes via unknown vectors. CVE-2012-4732 Cross-site request forgery (CSRF) vulnerability in Request Tracker (RT) 3.8.12 and other versions before 3.8.15, and 4.0.6 and other versions before 4.0.8, allows remote attackers to hijack the authentication of users for requests that toggle ticket bookmarks. CVE-2012-4734 Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote attackers to conduct a 'confused deputy' attack to bypass the CSRF warning protection mechanism and cause victims to 'modify arbitrary state' via unknown vectors related to a crafted link. CVE-2012-4884 Argument injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote attackers to create arbitrary files via unspecified vectors related to the GnuPG client. Solution: Update your system with the appropriate patches or software upgrades. CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2012-4730 http://lists.bestpractical.com/pipermail/rt-announce/2012-October/000212.html Common Vulnerability Exposure (CVE) ID: CVE-2012-4731 Debian Security Information: DSA-2568 (Google Search) http://www.debian.org/security/2012/dsa-2568 http://lists.bestpractical.com/pipermail/rt-announce/2012-October/000215.html http://secunia.com/advisories/51062 http://secunia.com/advisories/51111 Common Vulnerability Exposure (CVE) ID: CVE-2012-4732 http://osvdb.org/86714 Common Vulnerability Exposure (CVE) ID: CVE-2012-4734 http://osvdb.org/86709 Common Vulnerability Exposure (CVE) ID: CVE-2012-4735 Common Vulnerability Exposure (CVE) ID: CVE-2012-4884 Debian Security Information: DSA-2567 (Google Search) http://www.debian.org/security/2012/dsa-2567
Copyright	Copyright (C) 2012 E-Soft Inc.

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.