PT-2013-4326 · Best Practical · Request Tracker

Publicado 2013-08-23 · Atualizado 2017-09-03 · CVE-2013-3368

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Baixa

Vetor base

AV:L/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Request Tracker (RT) versions 3.8.x through 3.8.16 Request Tracker (RT) versions 4.0.x through 4.0.12

Description The issue allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name. This is related to the bin/rt component in Request Tracker (RT).

Recommendations For versions 3.8.x through 3.8.16, update to version 3.8.17 or later. For versions 4.0.x through 4.0.12, update to version 4.0.13 or later.

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2013-3368

DSA-2670-1

DSA-2671-1

MGASA-2017-0325

Produtos afetados

Request Tracker

Referências · 21

• http://secunia.com/advisories/53522 · Aviso do Fabricante
• http://secunia.com/advisories/53505 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-3368 · Nota de Segurança
• https://bugs.mageia.org/show_bug.cgi?id=16665 · Nota
• http://lists.bestpractical.com/pipermail/rt-announce/2017-June/000297.html · Nota
• http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html · Correção
• http://debian.org/security/2012/dsa-2670 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2013-3368 · Aviso do Fabricante
• http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html · Correção
• http://lists.bestpractical.com/pipermail/rt-announce/2015-August/000279.html · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-3368 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-3368 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2013-3368 · Aviso do Fabricante
• http://osvdb.org/93612 · Nota
• https://advisories.mageia.org/MGASA-2017-0325.html · Nota de Segurança