SB2011031103 - Multiple vulnerabilities in OTRS

Description

This security bulletin contains information about 2 vulnerabilities.

1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2010-4768)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote #AU# to read and manipulate data.

Open Ticket Request System (OTRS) before 2.3.5 does not properly disable hidden permissions, which allows remote authenticated users to bypass intended queue access restrictions in opportunistic circumstances by visiting a ticket, related to a certain ordering of permission-set and permission-remove operations involving both hidden permissions and other permissions.

2) OS Command Injection (CVE-ID: CVE-2011-0456)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

webscript.pl in Open Ticket Request System (OTRS) 2.3.4 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."

Remediation

Install update from vendor's website.

References

• http://bugs.otrs.org/show_bug.cgi?id=3499
• http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807
• http://jvn.jp/en/jp/JVN73162541/index.html
• http://jvndb.jvn.jp/jvndb/JVNDB-2011-000019
• http://secunia.com/advisories/43960
• https://hermes.opensuse.org/messages/7797670