REDHAT-BUG-672250
First published: Mon Jan 24 2011(Updated: )
It was found that Request Tracker, a ticket tracking and management system, stored user passwords in its database by using insufficiently secure hashing algorithm. A local attacker, able to gain read access to the RT's database could use this flaw to conduct brute force password guessing attacks, potentially leading to disclosure of users' passwords. References: [1] <a href="http://lists.bestpractical.com/pipermail/rt-announce/2011-January/000185.html">http://lists.bestpractical.com/pipermail/rt-announce/2011-January/000185.html</a> [2] <a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=610850">http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=610850</a> [3] <a href="http://www.debian.org/security/2011/dsa-2150">http://www.debian.org/security/2011/dsa-2150</a> RT Development Snapshots archive URL: [4] <a href="http://download.bestpractical.com/pub/rt/devel/">http://download.bestpractical.com/pub/rt/devel/</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Request Tracker |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.bestpractical.com/pipermail/rt-announce/2011-January/000185.html
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=610850
- http://www.debian.org/security/2011/dsa-2150
- http://download.bestpractical.com/pub/rt/devel/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=672257
- http://lists.bestpractical.com/pipermail/rt-announce/2011-February/000186.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=680217
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=672250#c3
- https://github.com/bestpractical/rt/blob/master/docs/UPGRADING-3.8
- https://bugzilla.redhat.com/show_bug.cgi?id=672250
Frequently Asked Questions
What is the severity of REDHAT-BUG-672250?
The severity of REDHAT-BUG-672250 is considered high due to the potential for local attackers to exploit weak password hashing.
How do I fix REDHAT-BUG-672250?
To fix REDHAT-BUG-672250, update to the latest version of Request Tracker that implements a more secure password hashing algorithm.
Who is affected by REDHAT-BUG-672250?
Users and administrators of the Request Tracker system are primarily affected by REDHAT-BUG-672250.
What are the risks associated with REDHAT-BUG-672250?
The risks associated with REDHAT-BUG-672250 include unauthorized access to user accounts through brute force password attacks.
Is there a patch available for REDHAT-BUG-672250?
Yes, a patch is available for REDHAT-BUG-672250 in the latest release of Request Tracker.
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-0009
- agent/severity
- agent/event
- agent/description
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/best practical
- canonical/request tracker