CVE-2011-2082: Medium severity best practical solutions request tracker vulnerability
Published Jun 4, 2012
·Updated
The vulnerable-passwords script in Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 does not update the password-hash algorithm for disabled user accounts, which makes it easier for context-dependent attackers to determine cleartext passwords, and possibly use these passwords after accounts are re-enabled, via a brute-force attack on the database. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-0009.
Affected Software
170 affected components
bestpractical RT=3.8.7
bestpractical RT=3.5.5
bestpractical RT=3.0.4
bestpractical RT=3.2.1-rc1
bestpractical RT=3.6.0-pre1
bestpractical RT=3.8.9-rc2
bestpractical RT=3.4.0-rc2
bestpractical RT=3.0.8
bestpractical RT=3.8.11
bestpractical RT=3.4.2-rc2
bestpractical RT=3.6.4-rc2
bestpractical RT=3.8.8-rc2
bestpractical RT=3.2.1-rc3
bestpractical RT=3.8.9-rc1
bestpractical RT=3.2.0-rc4
bestpractical RT=3.1.2
bestpractical RT=3.4.2-rc1
bestpractical RT=3.6.6-rc1
bestpractical RT=3.4.5
bestpractical RT=3.0.2
bestpractical RT=3.5.4
bestpractical RT=3.6.7
bestpractical RT=3.0.10-rc1
bestpractical RT=3.6.2
bestpractical RT=3.4.5-rc2
bestpractical RT=3.2.2
bestpractical RT=3.6.3
bestpractical RT=3.1.6
bestpractical RT=3.0.11
bestpractical RT=3.8.2
bestpractical RT=3.8.8-rc4
bestpractical RT=3.6.2-rc1
bestpractical RT=3.1.11
bestpractical RT=3.6.0-pre0
bestpractical RT=3.1.10
bestpractical RT=3.0.10-pre2
bestpractical RT=3.6.5-rc1
bestpractical RT=3.6.0
bestpractical RT=3.6.6-rc2
bestpractical RT=3.8.0
bestpractical RT=3.4.0-rc5
bestpractical RT=3.4.0
bestpractical RT=3.6.3-rc4
bestpractical RT=3.8.1-rc1
bestpractical RT=3.8.10
bestpractical RT=3.1.7
bestpractical RT=3.4.4-pre2
bestpractical RT=3.8.3-rc1
bestpractical RT=3.8.9
bestpractical RT=3.1.13
bestpractical RT=3.4.7-rc1
bestpractical RT=3.4.0-rc3
bestpractical RT=3.6.5-rc2
bestpractical RT=3.8.2-rc2
bestpractical RT=3.8.0-rc1
bestpractical RT=3.4.0-rc4
bestpractical RT=3.0.10
bestpractical RT=3.8.8-rc3
bestpractical RT=3.8.2-rc1
bestpractical RT=3.6.10
bestpractical RT=3.0.10-pre1
bestpractical RT=3.1.16
bestpractical RT=3.2.3
bestpractical RT=3.2.2-rc1
bestpractical RT=3.6.3-rc2
bestpractical RT=3.5.3
bestpractical RT=3.0.5
bestpractical RT=3.2.0
bestpractical RT=3.8.9-rc3
bestpractical RT=3.0.0
bestpractical RT=3.4.6
bestpractical RT=3.0.3
bestpractical RT=3.4.3
bestpractical RT=3.6.9
bestpractical RT=3.6.6
bestpractical RT=3.6.1-rc2
bestpractical RT=3.6.5
bestpractical RT=3.8.1-rc3
bestpractical RT=3.4.3-rc2
bestpractical RT=3.4.0-rc6
bestpractical RT=3.6.2-rc3
bestpractical RT=3.4.5-pre1
bestpractical RT=3.8.4-rc1
bestpractical RT=3.0.1
bestpractical RT=3.8.1-rc4
bestpractical RT=3.4.4-pre3
bestpractical RT=3.2.1
bestpractical RT=3.8.5
bestpractical RT=3.6.6-rc3
bestpractical RT=3.2.3-rc2
bestpractical RT=3.4.4
bestpractical RT=3.0.11-rc4
bestpractical RT=3.5.6
bestpractical RT=3.6.4-rc1
bestpractical RT=3.6.8
bestpractical RT=3.0.6
bestpractical RT=3.2.1-rc2
bestpractical RT=3.8.1-rc5
bestpractical RT=3.1.8
bestpractical RT=3.4.6-rc2
bestpractical RT=3.4.3-rc1
bestpractical RT=3.6.3-rc1
bestpractical RT=3.6.0-rc1
bestpractical RT=3.8.6-rc1
bestpractical RT=3.2.0-rc2
bestpractical RT=3.1.12
bestpractical RT=3.1.5
bestpractical RT=3.8.8
bestpractical RT=3.8.0-rc3
bestpractical RT=3.8.0-rc2
bestpractical RT=3.2.0-rc1
bestpractical RT=3.1.17
bestpractical RT=3.0.7
bestpractical RT=3.2.0-rc3
bestpractical RT=3.7.86
bestpractical RT=3.0.7.1
bestpractical RT=3.6.3-rc3
bestpractical RT=3.7.80
bestpractical RT=3.1.15
bestpractical RT=3.0.12
bestpractical RT=3.6.2-rc4
bestpractical RT=3.0.9
bestpractical RT=3.4.4-pre1
bestpractical RT=3.8.3
bestpractical RT=3.7.1
bestpractical RT=3.1.3
bestpractical RT=3.6.1
bestpractical RT=3.4.0-rc1
bestpractical RT=3.4.1
bestpractical RT=3.4.5-rc1
bestpractical RT=3.2.3-rc1
bestpractical RT=3.8.6
bestpractical RT=3.6.4
bestpractical RT=3.5.7
bestpractical RT=3.6.0-rc3
bestpractical RT=3.8.1
bestpractical RT=3.8.4
bestpractical RT=3.7.5
bestpractical RT=3.8.1-rc2
bestpractical RT=3.7.85
bestpractical RT=3.6.1-rc1
bestpractical RT=3.8.3-rc2
bestpractical RT=3.6.2-rc5
bestpractical RT=3.4.6-rc1
bestpractical RT=3.6.1-pre2
bestpractical RT=3.0.11-rc2
bestpractical RT=3.2.1-rc4
bestpractical RT=3.5.2
bestpractical RT=3.6.0-rc2
bestpractical RT=3.1.4
bestpractical RT=3.0.11-rc3
bestpractical RT=3.8.7-rc1
bestpractical RT=3.1.14
bestpractical RT=3.4.2
bestpractical RT=3.5.1
bestpractical RT=4.0.0-rc4
bestpractical RT=4.0.3
bestpractical RT=4.0.0-rc7
bestpractical RT=4.0.1
bestpractical RT=4.0.0-rc3
bestpractical RT=4.0.0-rc8
bestpractical RT=4.0.0-rc6
bestpractical RT=4.0.0-rc5
bestpractical RT=4.0.4
bestpractical RT=4.0.0-rc2
bestpractical RT=4.0.0
bestpractical RT=3.8.12
bestpractical RT=4.0.2
bestpractical RT=4.0.0-rc1
bestpractical RT=4.0.5
Remediation
Event History
Jun 4, 2012
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2011-2082?
CVE-2011-2082 has a medium severity rating due to its potential to allow unauthorized access to password information for disabled accounts.
2
How do I fix CVE-2011-2082?
To fix CVE-2011-2082, upgrade to RT version 3.8.12 or later, or 4.0.6 or later.
3
What versions are affected by CVE-2011-2082?
CVE-2011-2082 affects Best Practical Solutions RT versions prior to 3.8.12 and 4.0.6.
4
Who is affected by CVE-2011-2082?
User accounts that are disabled in the affected RT versions are vulnerable to attacks that can exploit this issue.
5
What is the impact of CVE-2011-2082?
The impact of CVE-2011-2082 is that it can lead to the exposure of cleartext passwords for disabled users, which may be exploited by context-dependent attackers.