-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In late September, a customer contacted us to report a session fixation vulnerability in RT 3.8.5 and all earlier versions back to and including RT 3.0.0. Over the course of the past month, we've worked to develop and release a version of RT not vulnerable to this issue as well as a "hot patch" to earlier versions of RT which eliminates the vulnerability with minimal code changes. RT 3.8.6, released on October 19th, is _not_ vulnerable. We have been assigned CVE number CVE-2009-3585 for this issue. This issue could allow a malicious attacker who can operate a server in the same domain (example.com where RT is rt.example.com) to obtain and redistribute an RT session identifier to an unsuspecting user before they log into RT. When that user logs in, the attacker would then be able to hijack the user's session. As part of an internal audit of the session handling code, we found and fixed an additional, related vulnerability which could allow an attacker with HTTP access to the RT server to construct a similar attack without the need for a server within the same domain. If you are using an external auth source (such as apache) you are not vulnerable to this attack. This only applies to RT's built-in $WebExternalAuth setting. RT-Authen-ExternalAuth does not protect you from this attack. I have attached six patches which should cover all vulnerable versions of RT 3. RT 3.6.10 will be released later today and will include a version of this patch. As mentioned before, RT 3.8.6 is _not_ vulnerable. The SHA1s of patches are: 38e0a8ce3480807a5dd6cc4da0eb51183382cddd RT-3.0.0-session_fixation.v3.patch de22a6e67d7d9d163a392d92530818f3d28e0af2 RT-3.0.1-3.0.6-session_fixation.v3.patch 03fb855a449393ef93db67b800d396bdbfb38a8f RT-3.0.7-3.6.1-session_fixation.v3.patch 7e5acff213a735894663f63fac90c95089a5e5d1 RT-3.6.2-3.6.3-session_fixation.v3.patch 9c60e647c848e35cea5a6ffe36bdd1f0a355c91f RT-3.6.4-3.6.9-session_fixation.v2.patch ada53ca94fdb4db3b185a7e14405d5a9ef76017f RT-3.8-session_fixation.patch RT 3.0.0 $ cd /opt/rt3/share $ patch -p1 < /path/to/RT-3.0.0-session_fixation.v3.patch RT 3.0.1-3.0.6 $ cd /opt/rt3/share $ patch -p1 < /path/to/RT-3.0.1-3.0.6-session_fixation.v3.patch RT 3.0.7-3.6.1 $ cd /opt/rt3/share $ patch -p1 < /path/to/RT-3.0.7-3.6.1-session_fixation.v3.patch RT 3.6.2-3.6.3 $ cd /opt/rt3/share $ patch -p1 < RT-3.6.2-3.6.3-session_fixation.v3.patch RT 3.6.4-3.6.9 $ cd /opt/rt3/share $ patch -p1 < RT-3.6.4-3.6.9-session_fixation.v2.patch RT 3.8.0-3.8.5 $ cd /opt/rt3/share $ patch -p1 < /path/to/RT-3.8-session_fixation.patch You should then clear your mason cache. If your RT is installed in /opt/rt3, you would use this command: $ rm -rf /opt/rt3/var/mason_data/obj/* and restart your webserver, this is often accomplished with $ /etc/init.d/httpd restart (or) $ /etc/init.d/apache restart I apologize for any inconvenience that this issue may have caused you. We go to great lengths to make sure that RT is robust and secure, but, as with any software, occasionally we do find defects. We do our best to deal with them quickly and responsibly. I'd like to thank Mikal Gule and the University of Oslo for bringing this issue to our attention and working with us to triage it and test the patches included below. I'd also like to thank Thomas Goetz, who also brought a variant of this issue to our attention. If you require assistance evaluating whether your RT deployment is vulnerable to this issue or deploying the patch, please don't hesitate to contact us at sales@bestpractical.com. While we're not able to provide commercial support without charge, we'll make every effort to provide help for this issue as quickly and as inexpensively as possible. Best, Jesse Vincent Best Practical -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEUEARECAAYFAksT+WcACgkQEi9d9xCOQEafCwCYpvl6m0W0W/VQnFhzr8jwHdfX dgCcDO6fi1XudFJc3jKYowci1VoqwxU= =cI4e -----END PGP SIGNATURE-----
Download RT-3.0.0-session_fixation.v3
Download RT-3.0.1-3.0.6-session_fixation.v3
Download RT-3.0.7-3.6.1-session_fixation.v3
Download RT-3.6.2-3.6.3-session_fixation.v3