SB2011031103 - Multiple vulnerabilities in OTRS

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2010-4768)

The vulnerability allows a remote #AU# to read and manipulate data.

Open Ticket Request System (OTRS) before 2.3.5 does not properly disable hidden permissions, which allows remote authenticated users to bypass intended queue access restrictions in opportunistic circumstances by visiting a ticket, related to a certain ordering of permission-set and permission-remove operations involving both hidden permissions and other permissions.

2) OS Command Injection (CVE-ID: CVE-2011-0456)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

webscript.pl in Open Ticket Request System (OTRS) 2.3.4 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."

Remediation

Install update from vendor's website.

References

• http://bugs.otrs.org/show_bug.cgi?id=3499
• http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807
• http://jvn.jp/en/jp/JVN73162541/index.html
• http://jvndb.jvn.jp/jvndb/JVNDB-2011-000019
• http://secunia.com/advisories/43960
• https://hermes.opensuse.org/messages/7797670