RT 'Devel::StackTrace' Perl Module Remote Denial of Service Vulnerability

Bugtraq ID:	29925
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2008-3502
Remote:	Yes
Local:	No
Published:	Jun 23 2008 12:00AM
Updated:	May 07 2015 05:28PM
Credit:	Rune Hammersland
Vulnerable:	Bestpractical RT 3.6.6 Bestpractical RT 3.0.1 Bestpractical RT 3.0
Not Vulnerable:	Bestpractical RT 3.6.7

RT 'Devel::StackTrace' Perl Module Remote Denial of Service Vulnerability

RT is prone to a remote denial-of-service vulnerability because it fails to handle exceptional conditions.

Attackers can exploit this issue to exhaust virtual memory or consume CPU resources, resulting in a denial-of-service condition.

Versions prior to RT 3.6.7 are vulnerable.

RT 'Devel::StackTrace' Perl Module Remote Denial of Service Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

RT 'Devel::StackTrace' Perl Module Remote Denial of Service Vulnerability

Solution:
The vendor has released an update. Please see the references for more information.

RT 'Devel::StackTrace' Perl Module Remote Denial of Service Vulnerability

References:

• [Rt-announce] Security vulnerability in RT 3.0 and up (Best Practical Solutions)
  
• RT Homepage (Best Practical Solutions)