=====================================================================
                                   CERT-Renater

                        Note d'Information No. 2009/VULN489
_____________________________________________________________________

DATE                      : 02/12/2009

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Systems running RT versions 3.0.0 up to and including 3.8.5.

======================================================================
http://lists.bestpractical.com/pipermail/rt-announce/2009-November/000177.html
http://lists.bestpractical.com/pipermail/rt-announce/2009-November/000176.html
______________________________________________________________________

This is a security release of RT.

It includes a fix for the session fixation vulnerability detailed in the following announcements:
http://blog.bestpractical.com/2009/11/session-fixation-vulnerability.html
http://lists.bestpractical.com/pipermail/rt-announce/2009-November/000176.html

You can download it here:

http://download.bestpractical.com/pub/rt/release/rt-3.6.10.tar.gz
http://download.bestpractical.com/pub/rt/release/rt-3.6.10.tar.gz.sig

SHA1 sums

145124d3ce7dcae76a935f9ce373825ca5fb6e7d  rt-3.6.10.tar.gz
4322f23057c14296ece60dc9f8e242ba5ea2a155  rt-3.6.10.tar.gz.sig


A complete list of changes since 3.6.9 is included below.

-kevin

commit 81f0759f2852c5b3950f48849300eed5a7166f7f
Author: Alex Vandiver <alexmv at bestpractical.com>
Date:   Wed Sep 30 17:07:24 2009 -0400

    Remove references to .svn

commit e28bfabe51ad2b53ca33a7328d3bd6a202d504d8
Author: Alex Vandiver <alexmv at bestpractical.com>
Date:   Wed Sep 30 17:08:29 2009 -0400

    Remove old and incorrect releng.cnf

commit e82d5f9b82ebbe3f6556d5ad3bda44f9476d6864
Author: Alex Vandiver <alexmv at bestpractical.com>
Date:   Tue Oct 6 14:18:44 2009 -0400

    Use spaces instead of tabs in commands, otherwise copy-and-paste in the terminal can fail

commit b157bae9d06e22c8cdbc6d1c74e93ae586bd37db
Author: Alex Vandiver <alexmv at bestpractical.com>
Date:   Tue Oct 6 14:27:26 2009 -0400

    Add .gitignore from 3.8-trunk

commit a8f7dccfb53118c950cc8bebff3e64c069c978a7
Author: Kevin Falcone <falcone at bestpractical.com>
Date:   Mon Nov 30 13:45:26 2009 -0500

    Apply patch for session fixation vulnerability (CVE-2009-3585)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
Url : http://lists.bestpractical.com/pipermail/rt-announce/attachments/20091130/d4db141f/attachment.pgp
______________________________________________________________________________________



In late September, a customer contacted us to report a session fixation
vulnerability in RT 3.8.5 and all earlier versions back to and including
RT 3.0.0.  Over the course of the past month, we've worked to develop
and release a version of RT not vulnerable to this issue as well as a
"hot patch" to earlier versions of RT which eliminates the vulnerability
with minimal code changes.  RT 3.8.6, released on October 19th, is _not_
vulnerable.

We have been assigned CVE number CVE-2009-3585 for this issue.

This issue could allow a malicious attacker who can operate a server in
the same domain (example.com where RT is rt.example.com) to obtain and
redistribute an RT session identifier to an unsuspecting user before
they log into RT.  When that user logs in, the attacker would then be
able to hijack the user's session.

As part of an internal audit of the session handling code, we found and
fixed an additional, related vulnerability which could allow an attacker
with HTTP access to the RT server to construct a similar attack without
the need for a server within the same domain.

If you are using RT's $WebExternalAuth configuration variable, you are
not vulnerable to this issue (but should still apply this patch).
If you are using the RT extension "RT-Authen-ExternalAuth", you must apply
this patch. RT-Authen-ExternalAuth does NOT protect you from this
vulnerability.

I have attached six patches which should cover all vulnerable versions
of RT 3.  RT 3.6.10 will be released later today and will include a
version of this patch.  As mentioned before, RT 3.8.6 is _not_ vulnerable.

The SHA1s of patches are:
38e0a8ce3480807a5dd6cc4da0eb51183382cddd  RT-3.0.0-session_fixation.v3.patch
de22a6e67d7d9d163a392d92530818f3d28e0af2  RT-3.0.1-3.0.6-session_fixation.v3.patch
03fb855a449393ef93db67b800d396bdbfb38a8f  RT-3.0.7-3.6.1-session_fixation.v3.patch
7e5acff213a735894663f63fac90c95089a5e5d1  RT-3.6.2-3.6.3-session_fixation.v3.patch
9c60e647c848e35cea5a6ffe36bdd1f0a355c91f  RT-3.6.4-3.6.9-session_fixation.v2.patch
ada53ca94fdb4db3b185a7e14405d5a9ef76017f  RT-3.8-session_fixation.patch

RT 3.0.0

 $ cd /opt/rt3/share
 $ patch -p1 < /path/to/RT-3.0.0-session_fixation.v3.patch

RT 3.0.1-3.0.6

 $ cd /opt/rt3/share
 $ patch -p1 < /path/to/RT-3.0.1-3.0.6-session_fixation.v3.patch

RT 3.0.7-3.6.1

 $ cd /opt/rt3/share
 $ patch -p1 < /path/to/RT-3.0.7-3.6.1-session_fixation.v3.patch


RT 3.6.2-3.6.3

 $ cd /opt/rt3/share
 $ patch -p1 < RT-3.6.2-3.6.3-session_fixation.v3.patch

RT 3.6.4-3.6.9

 $ cd /opt/rt3/share
 $ patch -p1 < RT-3.6.4-3.6.9-session_fixation.v2.patch

RT 3.8.0-3.8.5

 $ cd /opt/rt3/share
 $ patch -p1 < /path/to/RT-3.8-session_fixation.patch

You should then clear your mason cache. If your RT is installed in
/opt/rt3, you would use this command:

 $ rm -rf /opt/rt3/var/mason_data/obj/*

and restart your webserver, this is often accomplished with

 $ /etc/init.d/httpd restart
   (or)
 $ /etc/init.d/apache restart

I apologize for any inconvenience that this issue may have caused you.
We go to great lengths to make sure that RT is robust and secure, but,
as with any software, occasionally we do find defects.  We do our best
to deal with them quickly and responsibly.

I'd like to thank Mikal Gule and the University of Oslo for bringing
this issue to our attention and working with us to triage it and test
the patches included below.  I'd also like to thank Thomas Goetz, who
also brought a variant of this issue to our attention.

If you require assistance evaluating whether your RT deployment is
vulnerable to this issue or deploying the patch, please don't hesitate to
contact us at sales at bestpractical.com.  While we're not able to provide
commercial support without charge, we'll make every effort to provide
help for this issue as quickly and as inexpensively as possible.

Best,

Jesse Vincent
Best Practical
-------------- next part --------------
A non-text attachment was scrubbed...
Name: RT-3.0.0-session_fixation.v3.patch
Type: text/x-diff
Size: 1367 bytes
Desc: not available
Url : http://lists.bestpractical.com/pipermail/rt-announce/attachments/20091130/c06e2efe/attachment.patch
-------------- next part --------------
A non-text attachment was scrubbed...
Name: RT-3.0.1-3.0.6-session_fixation.v3.patch
Type: text/x-diff
Size: 1796 bytes
Desc: not available
Url : http://lists.bestpractical.com/pipermail/rt-announce/attachments/20091130/c06e2efe/attachment-0001.patch
-------------- next part --------------
A non-text attachment was scrubbed...
Name: RT-3.0.7-3.6.1-session_fixation.v3.patch
Type: text/x-diff
Size: 1819 bytes
Desc: not available
Url : http://lists.bestpractical.com/pipermail/rt-announce/attachments/20091130/c06e2efe/attachment-0002.patch
-------------- next part --------------
A non-text attachment was scrubbed...
Name: RT-3.8-session_fixation.patch
Type: text/x-diff
Size: 1007 bytes
Desc: not available
Url : http://lists.bestpractical.com/pipermail/rt-announce/attachments/20091130/c06e2efe/attachment-0003.patch
-------------- next part --------------
A non-text attachment was scrubbed...
Name: RT-3.6.2-3.6.3-session_fixation.v3.patch
Type: text/x-diff
Size: 1226 bytes
Desc: not available
Url : http://lists.bestpractical.com/pipermail/rt-announce/attachments/20091130/c06e2efe/attachment-0004.patch
-------------- next part --------------
A non-text attachment was scrubbed...
Name: RT-3.6.4-3.6.9-session_fixation.v2.patch
Type: text/x-diff
Size: 996 bytes
Desc: not available
Url : http://lists.bestpractical.com/pipermail/rt-announce/attachments/20091130/c06e2efe/attachment-0005.patch
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: Digital signature
Url : http://lists.bestpractical.com/pipermail/rt-announce/attachments/20091130/c06e2efe/attachment.pgp


======================================================================

          =========================================================
          Les serveurs de référence du CERT-Renater
          http://www.urec.fr/securite
          http://www.cru.fr/securite
          http://www.renater.fr
          =========================================================
          + CERT-RENATER          | tel : 01-53-94-20-44          +
          + 151 bd de l'Hopital   | fax : 01-53-94-20-41          +
          + 75013 Paris           | email: certsvp@renater.fr     +
          =========================================================