PT-2011-2011 · Best Practical Solutions · Rt

Published 2011-01-25 · Updated 2023-02-13 · CVE-2011-0009

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Best Practical Solutions RT versions 3.x through 3.8.9rc1 Best Practical Solutions RT versions 4.x through 4.0.0rc3

Description The issue makes it easier for attackers to determine cleartext passwords via a brute-force attack on the database, due to the use of the MD5 algorithm for password hashes.

Recommendations For versions 3.x through 3.8.9rc1, update to version 3.8.9rc2 or later. For versions 4.x through 4.0.0rc3, update to version 4.0.0rc4 or later.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2011-0009

DSA-2150-1

Affected Products

Rt

References · 14

• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=610850 · Patch
• http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054740.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0009 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=672250 · Patch
• http://lists.bestpractical.com/pipermail/rt-announce/2011-January/000185.html · Patch
• http://secunia.com/advisories/43438 · Vendor Advisory
• http://vupen.com/english/advisories/2011/0475 · Vendor Advisory
• http://vupen.com/english/advisories/2011/0190 · Vendor Advisory
• http://vupen.com/english/advisories/2011/0576 · Vendor Advisory
• http://debian.org/security/2011/dsa-2150 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0009 · Note
• http://securityfocus.com/bid/45959 · Note
• http://osvdb.org/70661 · Note
• https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E · Note