SB2011031803 - Input validation error in OTRS

Description

This security bulletin contains information about 1 vulnerability.

1) Input validation error (CVE-ID: CVE-2008-7278)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The S/MIME feature in Open Ticket Request System (OTRS) before 2.2.5, and 2.3.x before 2.3.0-beta1, does not properly configure the RANDFILE environment variable for OpenSSL, which might make it easier for remote attackers to decrypt e-mail messages that had lower than intended entropy available for cryptographic operations, related to inability to write to the seeding file.

Remediation

Install update from vendor's website.

References

• http://bugs.otrs.org/show_bug.cgi?id=2539
• http://bugs.otrs.org/show_bug.cgi?id=2844
• http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807