SB2012100801 - Multiple vulnerabilities in Ruby Redmine

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2011-4929)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Unspecified vulnerability in the bazaar repository adapter in Redmine 0.9.x and 1.0.x before 1.0.5 allows remote attackers to execute arbitrary commands via unknown vectors.

2) Input validation error (CVE-ID: CVE-2011-4927)

The vulnerability allows a remote #AU# to gain access to sensitive information.

Unspecified vulnerability in the bazaar repository adapter in Redmine 1.0.x before 1.0.5 allows remote authenticated users to obtain sensitive information via unknown vectors.

Remediation

Install update from vendor's website.

References

• http://www.debian.org/security/2011/dsa-2261
• http://www.openwall.com/lists/oss-security/2012/01/06/5
• http://www.openwall.com/lists/oss-security/2012/01/06/7
• http://www.redmine.org/news/49