OneOrZero Open Source Task Management and Help Desk System Information Disclosure Vulnerability

Bugtraq ID:	20651
Class:	Configuration Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 20 2006 12:00AM
Updated:	Oct 23 2006 10:43PM
Credit:	Michael Klingler is credited with discovering this issue.
Vulnerable:	OneOrZero OneOrZero 1.6.4 OneOrZero OneOrZero 1.6.3 OneOrZero OneOrZero 1.6
Not Vulnerable:	OneOrZero OneOrZero 1.6.5 .4

OneOrZero Open Source Task Management and Help Desk System Information Disclosure Vulnerability

OneOrZero Open Source Task Management and Help Desk System are prone to an information-disclosure vulnerability.

An attacker may exploit this issue to reset the administrative password and gain full access to the vulnerable software. This may lead to other attacks.

Versions 1.6.0 to 1.6.4 are vulnerable to this issue.

OneOrZero Open Source Task Management and Help Desk System Information Disclosure Vulnerability

Attackers can exploit this issue through a web client.

OneOrZero Open Source Task Management and Help Desk System Information Disclosure Vulnerability

Solution:
The vendor has released version 1.6.5.4 to address this issue. Please contact the vendor for information on how to obtain and apply this update.

OneOrZero Open Source Task Management and Help Desk System Information Disclosure Vulnerability

References:

• OneOrZero Helpdesk Homepage (OneOrZero)
  
• Advisory for Oneorzero helpdesk (Mike Klingler)