REDHAT-BUG-672250: Low severity request tracker vulnerability
It was found that Request Tracker, a ticket tracking and management system, stored user passwords in its database by using insufficiently secure hashing algorithm. A local attacker, able to gain read access to the RT's database could use this flaw to conduct brute force password guessing attacks, potentially leading to disclosure of users' passwords.
References: [1] http://lists.bestpractical.com/pipermail/rt-announce/2011-January/000185.html [2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=610850 [3] http://www.debian.org/security/2011/dsa-2150
RT Development Snapshots archive URL: [4] http://download.bestpractical.com/pub/rt/devel/
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-672250?
The severity of REDHAT-BUG-672250 is considered high due to the potential for local attackers to exploit weak password hashing.
How do I fix REDHAT-BUG-672250?
To fix REDHAT-BUG-672250, update to the latest version of Request Tracker that implements a more secure password hashing algorithm.
Who is affected by REDHAT-BUG-672250?
Users and administrators of the Request Tracker system are primarily affected by REDHAT-BUG-672250.
What are the risks associated with REDHAT-BUG-672250?
The risks associated with REDHAT-BUG-672250 include unauthorized access to user accounts through brute force password attacks.
Is there a patch available for REDHAT-BUG-672250?
Yes, a patch is available for REDHAT-BUG-672250 in the latest release of Request Tracker.