CVE Request -- rt3 -- two issues: 1) Improper management of form data resubmittion upon user log out 2) SQL queries information leak by user account transition

[Jan Lieskovsky <jlieskov () redhat com>]

Hello Josh, Steve, vendors,

  RT3 upstream has released latest v3.8.9 version:
  [1] http://lists.bestpractical.com/pipermail/rt-announce/2011-February/000186.html

  addressing three security flaws:
  1) * Move to a SHA-256 based password hashing scheme
     This has already got CVE id of CVE-2011-0009:
     http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0009

  2) * Redirect users to their desired pages after login.
     This prevents possible back button attacks after a user logs out.

     Further issue details:
     A security flaw was found in the way the RT3 ticketing
     system handled resubmitting of form data after the user
     has logged out of the browser (but not closed it).
     A local attacker could use this flaw to access the user
     account of the victim (login without providing a password
     or obtain user credentials).

     References:
     [a] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=614575
     [b] http://lists.bestpractical.com/pipermail/rt-announce/2011-February/000186.html

     Upstream bug report:
     [c] http://issues.bestpractical.com/Ticket/Display.html?id=15804

     Upstream changeset:
     [d] https://github.com/bestpractical/rt/commit/917c211820590950f7eb0521f7f43b31aeed44c4

     Thomas, could you please confirm [d] is the proper fix for 2) issue? Thank you.
     (* Redirect users to their desired pages after login.)

  3) * Clone Scrip's TicketObj since we change the CurrentUser and it can leak
     information (Custom field values, etc)

     Further issue details:
     A security flaw was found in the way the RT3 ticketing
     system handled logging of SQL queries during performing
     of user account transition. A remote, authenticated RT3
     user could use this flaw to obtain sensitive information.

     References:
     [i]  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=614576
     [ii] http://lists.bestpractical.com/pipermail/rt-announce/2011-February/000186.html

     Upstream changeset (needs confirmation from upstream if it's
     real fix for the issue yet):
     [iii] https://github.com/bestpractical/rt/commit/56e20b874e8d67ab93aa80c2c00155110a27e764

     Shawn, could you please confirm [iii] is the proper fix for 3) issue?
     (* Clone Scrip's TicketObj since we change the CurrentUser and it can leak)

     If [iii] not being the correct one for 3) issue, could you point us
     to the right one? Thank you.


Steve, once patches confirmed, could you allocate CVE ids for the 2), and 3) issues?

Thanks && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team