CVE-2011-0009 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0009): Best Practical Solutions RT 3.x before 3.8.9rc2 and 4.x before 4.0.0rc4 uses the MD5 algorithm for password hashes, which makes it easier for context-dependent attackers to determine cleartext passwords via a brute-force attack on the database.
CVE-2011-1690 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1690): Best Practical Solutions RT 3.6.0 through 3.6.10 and 3.8.0 through 3.8.8 allows remote attackers to trick users into sending credentials to an arbitrary server via unspecified vectors. CVE-2011-1689 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1689): Multiple cross-site scripting (XSS) vulnerabilities in Best Practical Solutions RT 2.0.0 through 3.6.10, 3.8.0 through 3.8.9, and 4.0.0rc through 4.0.0rc7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. CVE-2011-1688 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1688): Directory traversal vulnerability in Best Practical Solutions RT 3.2.0 through 3.6.10, 3.8.0 through 3.8.9, and 4.0.0rc through 4.0.0rc7 allows remote attackers to read arbitrary files via a crafted HTTP request. CVE-2011-1687 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1687): Best Practical Solutions RT 3.0.0 through 3.6.10, 3.8.0 through 3.8.9, and 4.0.0rc through 4.0.0rc7 allows remote authenticated users to obtain sensitive information by using the search interface, as demonstrated by retrieving encrypted passwords. CVE-2011-1686 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1686): Multiple SQL injection vulnerabilities in Best Practical Solutions RT 2.0.0 through 3.6.10, 3.8.0 through 3.8.9, and 4.0.0rc through 4.0.0rc7 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors, as demonstrated by reading data. CVE-2011-1685 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1685): Best Practical Solutions RT 3.8.0 through 3.8.9 and 4.0.0rc through 4.0.0rc7, when the CustomFieldValuesSources (aka external custom field) option is enabled, allows remote authenticated users to execute arbitrary code via unspecified vectors, as demonstrated by a cross-site request forgery (CSRF) attack. CVE-2011-1008 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1008): Scrips_Overlay.pm in Best Practical Solutions RT before 3.8.9 does not properly restrict access to a TicketObj in a Scrip after a CurrentUser change, which allows remote authenticated users to obtain sensitive information via unspecified vectors, as demonstrated by custom-field value information, related to SQL logging. CVE-2011-1007 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1007): Best Practical Solutions RT before 3.8.9 does not perform certain redirect actions upon a login, which allows physically proximate attackers to obtain credentials by resubmitting the login form via the back button of a web browser on an unattended workstation after an RT logout.
I am currently working on bumping rt from 3.6.7 -> 3.8.10 and finally 4.0.2. 3.8.10 resolves all of these issues, and work is being done in bug #235914. I have posted a diff for 3.8.10 and I'm waiting for my proxy maintainer to sign off on it.
rt-3.8.10 is in tree. No stable version => this bug is fixed.
Thanks Peter, folks. Closing noglsa.
