Bug 679396 (CVE-2011-1007)

Summary:	CVE-2011-1007 rt3: Improper management of form data resubmittion upon user log out
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	mmahut, ovitters, rc040203, tremble, xavier
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	rt3 3.8.9	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-10-05 20:55:15 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	680217, 680218
Bug Blocks:

Description Jan Lieskovsky 2011-02-22 13:35:59 UTC

A security flaw was found in the way the RT3 ticketing
system handled resubmitting of form data after the user 
has logged out of the browser (but not closed it).
A local attacker could use this flaw to access the user
account of the victim (login without providing a password
or obtain user credentials).

References:
[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=614575
[2] http://lists.bestpractical.com/pipermail/rt-announce/2011-February/000186.html

Upstream bug report:
[3] http://issues.bestpractical.com/Ticket/Display.html?id=15804

Upstream changeset:
[4] https://github.com/bestpractical/rt/commit/917c211820590950f7eb0521f7f43b31aeed44c4

Comment 1 Jan Lieskovsky 2011-02-22 13:43:39 UTC

This issue affects the versions of the rt3 package, as shipped with
Fedora release of 13 and 14.

--

This issue affects the version of the rt3 package, as present within
EPEL-6 repository.

Comment 2 Jan Lieskovsky 2011-02-22 14:37:21 UTC

CVE Request:
[5] http://www.openwall.com/lists/oss-security/2011/02/22/6

Comment 3 Vincent Danen 2011-02-24 17:06:45 UTC

This was assigned CVE-2011-1007:

http://www.openwall.com/lists/oss-security/2011/02/22/12

Comment 4 Vincent Danen 2011-02-24 17:24:54 UTC

Created rt3 tracking bugs for this issue

Affects: fedora-all [bug 680218]
Affects: epel-6 [bug 680217]

Comment 5 Fedora Update System 2011-10-27 19:06:17 UTC

rt3-3.6.11-2.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Vincent Danen 2012-10-05 20:55:15 UTC

Current Fedora/EPEL6 have 3.8.13 so are fixed.