RT Session Fixation Vulnerability

Bugtraq ID:	37162
Class:	Design Error
CVE:	CVE-2009-3585
Remote:	Yes
Local:	No
Published:	Nov 30 2009 12:00AM
Updated:	Apr 13 2015 10:15PM
Credit:	Mikal Gule and the University of Oslo, Thomas Goetz
Vulnerable:	Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 Bestpractical RT 3.8.5 Bestpractical RT 3.8.4 Bestpractical RT 3.8.2 Bestpractical RT 3.6.9 Bestpractical RT 3.6.8 Bestpractical RT 3.6.7 Bestpractical RT 3.6.6 Bestpractical RT 3.6.2 Bestpractical RT 3.0.1 Bestpractical RT 3.0
Not Vulnerable:	Bestpractical RT 3.8.6

RT Session Fixation Vulnerability

RT is prone to a session-fixation vulnerability.

Attackers can exploit this issue to hijack a user's session and gain unauthorized access to the affected application.

The issue affects RT 3.0.0 through 3.8.5.

RT Session Fixation Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim into following a malicious URI.

RT Session Fixation Vulnerability

Solution:
Updates are available. Please see the references for more information.


Debian Linux 4.0 arm

• Debian request-tracker3.4_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/requ est-tracker3.4_3.4.5-2+etch1_all.deb


• Debian request-tracker3.6_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/requ est-tracker3.6_3.6.1-4+etch1_all.deb


• Debian rt3.4-apache_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-apache_3.4.5-2+etch1_all.deb


• Debian rt3.4-apache2_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-apache2_3.4.5-2+etch1_all.deb


• Debian rt3.4-clients_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-clients_3.4.5-2+etch1_all.deb


• Debian rt3.6-apache_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache_3.6.1-4+etch1_all.deb


• Debian rt3.6-apache2_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache2_3.6.1-4+etch1_all.deb


• Debian rt3.6-clients_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-clients_3.6.1-4+etch1_all.deb

Debian Linux 5.0 ia-64

• Debian request-tracker3.6_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/requ est-tracker3.6_3.6.7-5+lenny3_all.deb


• Debian rt3.6-apache2_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache2_3.6.7-5+lenny3_all.deb


• Debian rt3.6-clients_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-clients_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-mysql_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-mysql_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-postgresql_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-postgresql_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-sqlite_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-sqlite_3.6.7-5+lenny3_all.deb

Debian Linux 4.0 powerpc

• Debian request-tracker3.4_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/requ est-tracker3.4_3.4.5-2+etch1_all.deb


• Debian request-tracker3.6_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/requ est-tracker3.6_3.6.1-4+etch1_all.deb


• Debian rt3.4-apache_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-apache_3.4.5-2+etch1_all.deb


• Debian rt3.4-apache2_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-apache2_3.4.5-2+etch1_all.deb


• Debian rt3.4-clients_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-clients_3.4.5-2+etch1_all.deb


• Debian rt3.6-apache_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache_3.6.1-4+etch1_all.deb


• Debian rt3.6-apache2_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache2_3.6.1-4+etch1_all.deb


• Debian rt3.6-clients_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-clients_3.6.1-4+etch1_all.deb

Debian Linux 4.0 m68k

• Debian request-tracker3.4_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/requ est-tracker3.4_3.4.5-2+etch1_all.deb


• Debian request-tracker3.6_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/requ est-tracker3.6_3.6.1-4+etch1_all.deb


• Debian rt3.4-apache_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-apache_3.4.5-2+etch1_all.deb


• Debian rt3.4-apache2_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-apache2_3.4.5-2+etch1_all.deb


• Debian rt3.4-clients_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-clients_3.4.5-2+etch1_all.deb


• Debian rt3.6-apache_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache_3.6.1-4+etch1_all.deb


• Debian rt3.6-apache2_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache2_3.6.1-4+etch1_all.deb


• Debian rt3.6-clients_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-clients_3.6.1-4+etch1_all.deb

Debian Linux 5.0 alpha

• Debian request-tracker3.6_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/requ est-tracker3.6_3.6.7-5+lenny3_all.deb


• Debian rt3.6-apache2_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache2_3.6.7-5+lenny3_all.deb


• Debian rt3.6-clients_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-clients_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-mysql_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-mysql_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-postgresql_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-postgresql_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-sqlite_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-sqlite_3.6.7-5+lenny3_all.deb

Debian Linux 5.0 ia-32

• Debian request-tracker3.6_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/requ est-tracker3.6_3.6.7-5+lenny3_all.deb


• Debian rt3.6-apache2_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache2_3.6.7-5+lenny3_all.deb


• Debian rt3.6-clients_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-clients_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-mysql_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-mysql_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-postgresql_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-postgresql_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-sqlite_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-sqlite_3.6.7-5+lenny3_all.deb

Debian Linux 5.0 s/390

• Debian request-tracker3.6_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/requ est-tracker3.6_3.6.7-5+lenny3_all.deb


• Debian rt3.6-apache2_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache2_3.6.7-5+lenny3_all.deb


• Debian rt3.6-clients_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-clients_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-mysql_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-mysql_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-postgresql_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-postgresql_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-sqlite_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-sqlite_3.6.7-5+lenny3_all.deb

Debian Linux 5.0 mipsel

• Debian request-tracker3.6_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/requ est-tracker3.6_3.6.7-5+lenny3_all.deb


• Debian rt3.6-apache2_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache2_3.6.7-5+lenny3_all.deb


• Debian rt3.6-clients_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-clients_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-mysql_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-mysql_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-postgresql_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-postgresql_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-sqlite_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-sqlite_3.6.7-5+lenny3_all.deb

Debian Linux 4.0 amd64

• Debian request-tracker3.4_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/requ est-tracker3.4_3.4.5-2+etch1_all.deb


• Debian request-tracker3.6_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/requ est-tracker3.6_3.6.1-4+etch1_all.deb


• Debian rt3.4-apache_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-apache_3.4.5-2+etch1_all.deb


• Debian rt3.4-apache2_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-apache2_3.4.5-2+etch1_all.deb


• Debian rt3.4-clients_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-clients_3.4.5-2+etch1_all.deb


• Debian rt3.6-apache_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache_3.6.1-4+etch1_all.deb


• Debian rt3.6-apache2_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache2_3.6.1-4+etch1_all.deb


• Debian rt3.6-clients_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-clients_3.6.1-4+etch1_all.deb

Debian Linux 4.0 ia-32

• Debian request-tracker3.4_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/requ est-tracker3.4_3.4.5-2+etch1_all.deb


• Debian request-tracker3.6_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/requ est-tracker3.6_3.6.1-4+etch1_all.deb


• Debian rt3.4-apache_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-apache_3.4.5-2+etch1_all.deb


• Debian rt3.4-apache2_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-apache2_3.4.5-2+etch1_all.deb


• Debian rt3.4-clients_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-clients_3.4.5-2+etch1_all.deb


• Debian rt3.6-apache_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache_3.6.1-4+etch1_all.deb


• Debian rt3.6-apache2_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache2_3.6.1-4+etch1_all.deb


• Debian rt3.6-clients_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-clients_3.6.1-4+etch1_all.deb

Debian Linux 5.0 hppa

• Debian request-tracker3.6_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/requ est-tracker3.6_3.6.7-5+lenny3_all.deb


• Debian rt3.6-apache2_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache2_3.6.7-5+lenny3_all.deb


• Debian rt3.6-clients_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-clients_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-mysql_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-mysql_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-postgresql_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-postgresql_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-sqlite_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-sqlite_3.6.7-5+lenny3_all.deb

Debian Linux 4.0 hppa

• Debian request-tracker3.4_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/requ est-tracker3.4_3.4.5-2+etch1_all.deb


• Debian request-tracker3.6_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/requ est-tracker3.6_3.6.1-4+etch1_all.deb


• Debian rt3.4-apache_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-apache_3.4.5-2+etch1_all.deb


• Debian rt3.4-apache2_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-apache2_3.4.5-2+etch1_all.deb


• Debian rt3.4-clients_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-clients_3.4.5-2+etch1_all.deb


• Debian rt3.6-apache_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache_3.6.1-4+etch1_all.deb


• Debian rt3.6-apache2_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache2_3.6.1-4+etch1_all.deb


• Debian rt3.6-clients_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-clients_3.6.1-4+etch1_all.deb

Debian Linux 4.0 sparc

• Debian request-tracker3.4_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/requ est-tracker3.4_3.4.5-2+etch1_all.deb


• Debian request-tracker3.6_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/requ est-tracker3.6_3.6.1-4+etch1_all.deb


• Debian rt3.4-apache_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-apache_3.4.5-2+etch1_all.deb


• Debian rt3.4-apache2_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-apache2_3.4.5-2+etch1_all.deb


• Debian rt3.4-clients_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-clients_3.4.5-2+etch1_all.deb


• Debian rt3.6-apache_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache_3.6.1-4+etch1_all.deb


• Debian rt3.6-apache2_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache2_3.6.1-4+etch1_all.deb


• Debian rt3.6-clients_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-clients_3.6.1-4+etch1_all.deb

Debian Linux 4.0 s/390

• Debian request-tracker3.4_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/requ est-tracker3.4_3.4.5-2+etch1_all.deb


• Debian request-tracker3.6_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/requ est-tracker3.6_3.6.1-4+etch1_all.deb


• Debian rt3.4-apache_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-apache_3.4.5-2+etch1_all.deb


• Debian rt3.4-apache2_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-apache2_3.4.5-2+etch1_all.deb


• Debian rt3.4-clients_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-clients_3.4.5-2+etch1_all.deb


• Debian rt3.6-apache_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache_3.6.1-4+etch1_all.deb


• Debian rt3.6-apache2_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache2_3.6.1-4+etch1_all.deb


• Debian rt3.6-clients_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-clients_3.6.1-4+etch1_all.deb

Debian Linux 5.0 m68k

• Debian request-tracker3.6_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/requ est-tracker3.6_3.6.7-5+lenny3_all.deb


• Debian rt3.6-apache2_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache2_3.6.7-5+lenny3_all.deb


• Debian rt3.6-clients_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-clients_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-mysql_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-mysql_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-postgresql_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-postgresql_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-sqlite_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-sqlite_3.6.7-5+lenny3_all.deb

Debian Linux 5.0 arm

• Debian request-tracker3.6_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/requ est-tracker3.6_3.6.7-5+lenny3_all.deb


• Debian rt3.6-apache2_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache2_3.6.7-5+lenny3_all.deb


• Debian rt3.6-clients_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-clients_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-mysql_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-mysql_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-postgresql_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-postgresql_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-sqlite_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-sqlite_3.6.7-5+lenny3_all.deb

Debian Linux 4.0 armel

• Debian request-tracker3.4_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/requ est-tracker3.4_3.4.5-2+etch1_all.deb


• Debian request-tracker3.6_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/requ est-tracker3.6_3.6.1-4+etch1_all.deb


• Debian rt3.4-apache_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-apache_3.4.5-2+etch1_all.deb


• Debian rt3.4-apache2_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-apache2_3.4.5-2+etch1_all.deb


• Debian rt3.4-clients_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-clients_3.4.5-2+etch1_all.deb


• Debian rt3.6-apache_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache_3.6.1-4+etch1_all.deb


• Debian rt3.6-apache2_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache2_3.6.1-4+etch1_all.deb


• Debian rt3.6-clients_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-clients_3.6.1-4+etch1_all.deb

Debian Linux 4.0 alpha

• Debian request-tracker3.4_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/requ est-tracker3.4_3.4.5-2+etch1_all.deb


• Debian request-tracker3.6_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/requ est-tracker3.6_3.6.1-4+etch1_all.deb


• Debian rt3.4-apache_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-apache_3.4.5-2+etch1_all.deb


• Debian rt3.4-apache2_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-apache2_3.4.5-2+etch1_all.deb


• Debian rt3.4-clients_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-clients_3.4.5-2+etch1_all.deb


• Debian rt3.6-apache_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache_3.6.1-4+etch1_all.deb


• Debian rt3.6-apache2_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache2_3.6.1-4+etch1_all.deb


• Debian rt3.6-clients_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-clients_3.6.1-4+etch1_all.deb

Debian Linux 5.0 armel

• Debian request-tracker3.6_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/requ est-tracker3.6_3.6.7-5+lenny3_all.deb


• Debian rt3.6-apache2_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache2_3.6.7-5+lenny3_all.deb


• Debian rt3.6-clients_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-clients_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-mysql_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-mysql_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-postgresql_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-postgresql_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-sqlite_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-sqlite_3.6.7-5+lenny3_all.deb

Debian Linux 5.0

• Debian request-tracker3.6_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/requ est-tracker3.6_3.6.7-5+lenny3_all.deb


• Debian rt3.6-apache2_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache2_3.6.7-5+lenny3_all.deb


• Debian rt3.6-clients_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-clients_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-mysql_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-mysql_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-postgresql_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-postgresql_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-sqlite_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-sqlite_3.6.7-5+lenny3_all.deb

Debian Linux 4.0

• Debian request-tracker3.4_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/requ est-tracker3.4_3.4.5-2+etch1_all.deb


• Debian request-tracker3.6_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/requ est-tracker3.6_3.6.1-4+etch1_all.deb


• Debian rt3.4-apache_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-apache_3.4.5-2+etch1_all.deb


• Debian rt3.4-apache2_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-apache2_3.4.5-2+etch1_all.deb


• Debian rt3.4-clients_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-clients_3.4.5-2+etch1_all.deb


• Debian rt3.6-apache_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache_3.6.1-4+etch1_all.deb


• Debian rt3.6-apache2_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache2_3.6.1-4+etch1_all.deb


• Debian rt3.6-clients_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-clients_3.6.1-4+etch1_all.deb

Debian Linux 5.0 amd64

• Debian request-tracker3.6_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/requ est-tracker3.6_3.6.7-5+lenny3_all.deb


• Debian rt3.6-apache2_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache2_3.6.7-5+lenny3_all.deb


• Debian rt3.6-clients_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-clients_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-mysql_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-mysql_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-postgresql_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-postgresql_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-sqlite_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-sqlite_3.6.7-5+lenny3_all.deb

Debian Linux 4.0 mipsel

• Debian request-tracker3.4_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/requ est-tracker3.4_3.4.5-2+etch1_all.deb


• Debian request-tracker3.6_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/requ est-tracker3.6_3.6.1-4+etch1_all.deb


• Debian rt3.4-apache_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-apache_3.4.5-2+etch1_all.deb


• Debian rt3.4-apache2_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-apache2_3.4.5-2+etch1_all.deb


• Debian rt3.4-clients_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-clients_3.4.5-2+etch1_all.deb


• Debian rt3.6-apache_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache_3.6.1-4+etch1_all.deb


• Debian rt3.6-apache2_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache2_3.6.1-4+etch1_all.deb


• Debian rt3.6-clients_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-clients_3.6.1-4+etch1_all.deb

Debian Linux 5.0 mips

• Debian request-tracker3.6_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/requ est-tracker3.6_3.6.7-5+lenny3_all.deb


• Debian rt3.6-apache2_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache2_3.6.7-5+lenny3_all.deb


• Debian rt3.6-clients_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-clients_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-mysql_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-mysql_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-postgresql_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-postgresql_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-sqlite_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-sqlite_3.6.7-5+lenny3_all.deb

Debian Linux 5.0 powerpc

• Debian request-tracker3.6_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/requ est-tracker3.6_3.6.7-5+lenny3_all.deb


• Debian rt3.6-apache2_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache2_3.6.7-5+lenny3_all.deb


• Debian rt3.6-clients_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-clients_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-mysql_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-mysql_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-postgresql_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-postgresql_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-sqlite_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-sqlite_3.6.7-5+lenny3_all.deb

Debian Linux 4.0 ia-64

• Debian request-tracker3.4_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/requ est-tracker3.4_3.4.5-2+etch1_all.deb


• Debian request-tracker3.6_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/requ est-tracker3.6_3.6.1-4+etch1_all.deb


• Debian rt3.4-apache_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-apache_3.4.5-2+etch1_all.deb


• Debian rt3.4-apache2_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-apache2_3.4.5-2+etch1_all.deb


• Debian rt3.4-clients_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-clients_3.4.5-2+etch1_all.deb


• Debian rt3.6-apache_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache_3.6.1-4+etch1_all.deb


• Debian rt3.6-apache2_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache2_3.6.1-4+etch1_all.deb


• Debian rt3.6-clients_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-clients_3.6.1-4+etch1_all.deb

Debian Linux 4.0 mips

• Debian request-tracker3.4_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/requ est-tracker3.4_3.4.5-2+etch1_all.deb


• Debian request-tracker3.6_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/requ est-tracker3.6_3.6.1-4+etch1_all.deb


• Debian rt3.4-apache_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-apache_3.4.5-2+etch1_all.deb


• Debian rt3.4-apache2_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-apache2_3.4.5-2+etch1_all.deb


• Debian rt3.4-clients_3.4.5-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.4/rt3. 4-clients_3.4.5-2+etch1_all.deb


• Debian rt3.6-apache_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache_3.6.1-4+etch1_all.deb


• Debian rt3.6-apache2_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache2_3.6.1-4+etch1_all.deb


• Debian rt3.6-clients_3.6.1-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-clients_3.6.1-4+etch1_all.deb

Debian Linux 5.0 sparc

• Debian request-tracker3.6_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/requ est-tracker3.6_3.6.7-5+lenny3_all.deb


• Debian rt3.6-apache2_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-apache2_3.6.7-5+lenny3_all.deb


• Debian rt3.6-clients_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-clients_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-mysql_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-mysql_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-postgresql_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-postgresql_3.6.7-5+lenny3_all.deb


• Debian rt3.6-db-sqlite_3.6.7-5+lenny3_all.deb
  http://security.debian.org/pool/updates/main/r/request-tracker3.6/rt3. 6-db-sqlite_3.6.7-5+lenny3_all.deb

RT Session Fixation Vulnerability

References:

• [Rt-announce] SECURITY - RT 3.6.10 Released (Best Practical Solutions)
  
• [Rt-announce] SECURITY - Session Fixation Vulnerability in RT 3.0.0-3.8.5 (Best Practical Solutions)
  
• RT Homepage (Best Practical Solutions)