Best Practical Solutions RT (Request Tracker) ShowConfigTab Security Bypass Vulnerability

Bugtraq ID:	44227
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 10 2009 12:00AM
Updated:	Jun 10 2009 12:00AM
Credit:	Reported by the vendor
Vulnerable:	Best Practical Solutions RT 3.8.2 Best Practical Solutions RT 3.6.7 Best Practical Solutions RT 3.6.6 Best Practical Solutions RT 3.6.2
Not Vulnerable:	Best Practical Solutions RT 3.8.4 Best Practical Solutions RT 3.6.8

Best Practical Solutions RT (Request Tracker) ShowConfigTab Security Bypass Vulnerability

RT (Request Tracker) is prone to a security-bypass vulnerability.

A user with the 'ShowConfigTab' permission can exploit this issue to bypass certain security restrictions and gain unauthorized access.

The following versions are affected:

RT 3.6.x prior to 3.6.8
RT 3.8.x prior to 3.8.4

Best Practical Solutions RT (Request Tracker) ShowConfigTab Security Bypass Vulnerability

An attacker can exploit this issue by using readily available network utilities.

Best Practical Solutions RT (Request Tracker) ShowConfigTab Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for details.

Best Practical Solutions RT (Request Tracker) ShowConfigTab Security Bypass Vulnerability

References:

• [Rt-announce] RT 3.6.8 Released (Best Practical Solutions)
  
• [Rt-announce] RT 3.8.4 Released (Best Practical Solutions)
  
• RT Homepage (Best Practical Solutions)