Re: OTRS CVE-2011-0456

[Lukas Kuzmiak <lukash () backstep net>]

Hey Mimi,

I've been digging a little and found this:
http://lists.otrs.org/pipermail/dev/2011-March/002420.html

I don't really know OTRS well, so I'm not sure if what Martin Gruner says in
the thread is really like that, meaning:

However, this issue is related to
scripts/webform.pl, an example file which is not used by default in
OTRS, and therefore not directly vulnerable from outside.

Maybe you can rather focus on this one:

http://otrs.org/advisory/OSA-2010-01-en/

Cheers,

Lukas


On Thu, Sep 15, 2011 at 9:41 AM, <mimi () bankai-sec org> wrote:

> Hi,
> thanks a lot. That's a good starting point.
> If somebody else is working on this, just let me know :)
>
>
> > https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-0456
> > I've seen "Vincent Danen"'s comment, it seems to be relevant.
> _______________________________________________
> > https://mail.metasploit.com/mailman/listinfo/framework
>
> _______________________________________________
> https://mail.metasploit.com/mailman/listinfo/framework
_______________________________________________
https://mail.metasploit.com/mailman/listinfo/framework