CVE-2014-9472: High severity Debian Debian Linux vulnerability

Published Mar 9, 2015

Updated

The email gateway in RT (aka Request Tracker) 3.0.0 through 4.x before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to cause a denial of service (CPU and disk consumption) via a crafted email.

Affected Software

51 affected components

Debian Debian Linux=7.0

Fedoraproject Fedora=21

Fedoraproject Fedora=22

bestpractical Request Tracker=3.6.8

bestpractical Request Tracker=3.6.10

bestpractical Request Tracker=3.6.11

bestpractical Request Tracker=3.8.3

bestpractical Request Tracker=3.8.4

bestpractical Request Tracker=3.8.7

bestpractical Request Tracker=3.8.9

bestpractical Request Tracker=3.8.10

bestpractical Request Tracker=3.8.11

bestpractical Request Tracker=3.8.12

bestpractical Request Tracker=3.8.13

bestpractical Request Tracker=3.8.14

bestpractical Request Tracker=3.8.15

bestpractical Request Tracker=3.8.16

bestpractical Request Tracker=3.8.17

bestpractical Request Tracker=4.0.0

bestpractical Request Tracker=4.0.1

bestpractical Request Tracker=4.0.2

bestpractical Request Tracker=4.0.3

bestpractical Request Tracker=4.0.4

bestpractical Request Tracker=4.0.5

bestpractical Request Tracker=4.0.6

bestpractical Request Tracker=4.0.7

bestpractical Request Tracker=4.0.8

bestpractical Request Tracker=4.0.9

bestpractical Request Tracker=4.0.10

bestpractical Request Tracker=4.0.11

bestpractical Request Tracker=4.0.12

bestpractical Request Tracker=4.0.13

bestpractical Request Tracker=4.0.14

bestpractical Request Tracker=4.0.15

bestpractical Request Tracker=4.0.16

bestpractical Request Tracker=4.0.17

bestpractical Request Tracker=4.0.18

bestpractical Request Tracker=4.0.19

bestpractical Request Tracker=4.0.20

bestpractical Request Tracker=4.0.21

bestpractical Request Tracker=4.0.22

bestpractical Request Tracker=4.2.0

bestpractical Request Tracker=4.2.1

bestpractical Request Tracker=4.2.2

bestpractical Request Tracker=4.2.3

bestpractical Request Tracker=4.2.4

bestpractical Request Tracker=4.2.5

bestpractical Request Tracker=4.2.6

bestpractical Request Tracker=4.2.7

bestpractical Request Tracker=4.2.8

bestpractical Request Tracker=4.2.9

Event History

Mar 9, 2015

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-9472?

CVE-2014-9472 is categorized as a denial of service vulnerability, which can lead to high CPU and disk consumption.

How do I fix CVE-2014-9472?

To mitigate CVE-2014-9472, upgrade Your Request Tracker version to at least 4.0.23 or 4.2.10.

Who is affected by CVE-2014-9472?

CVE-2014-9472 affects versions of Request Tracker from 3.0.0 up to 4.0.22 and 4.2.x up to 4.2.9.

What kind of attacks exploit CVE-2014-9472?

CVE-2014-9472 can be exploited by remote attackers sending crafted emails that cause increased resource consumption.

Is there a workaround for CVE-2014-9472 if I cannot upgrade?

A potential workaround for CVE-2014-9472 would be to implement email filtering rules or rate limiting to block malformed emails.