Request Tracker CVE-2015-1464 Session Hijacking Vulnerability

Bugtraq ID:	72833
Class:	Input Validation Error
CVE:	CVE-2015-1464
Remote:	Yes
Local:	No
Published:	Feb 26 2015 12:00AM
Updated:	Feb 26 2015 12:00AM
Credit:	Christian Loos
Vulnerable:	Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 Bestpractical RT 4.2.8 Bestpractical RT 4.2.5 Bestpractical RT 4.2.2 Bestpractical RT 4.2.1 Bestpractical RT 4.2 Bestpractical RT 3.8.17 Bestpractical RT 3.8.16 Bestpractical RT 3.8.15 Bestpractical RT 3.8.11 Bestpractical RT 3.8.10 Bestpractical RT 3.8.8 Bestpractical RT 3.8.6 Bestpractical RT 3.8.5 Bestpractical RT 3.8.4 Bestpractical RT 3.8.2 Bestpractical RT 3.6.11 Bestpractical RT 3.6.10 Bestpractical RT 3.6.9 Bestpractical RT 3.6.8 Bestpractical RT 3.6.7 Bestpractical RT 3.6.6 Bestpractical RT 3.6.2 Bestpractical RT 3.0.1 Bestpractical RT 3.0 Bestpractical RT 2.0.15 Bestpractical RT 1.0.7 Bestpractical RT 1.0.6 Bestpractical RT 1.0.5 Bestpractical RT 1.0.4 Bestpractical RT 1.0.3 Bestpractical RT 1.0.2 Bestpractical RT 1.0.1 Bestpractical RT 1.0 Bestpractical RT 4.0.9 Bestpractical RT 4.0.8 Bestpractical RT 4.0.7 Bestpractical RT 4.0.6 Bestpractical RT 4.0.5 Bestpractical RT 4.0.4 Bestpractical RT 4.0.3 Bestpractical RT 4.0.2 Bestpractical RT 4.0.13 Bestpractical RT 4.0.12 Bestpractical RT 4.0.10 Bestpractical RT 4.0.1 Bestpractical RT 4.0 Bestpractical RT 3.8.9 Bestpractical RT 3.8.12 Bestpractical RT 3.8
Not Vulnerable:	Bestpractical RT 4.2.10

Request Tracker CVE-2015-1464 Session Hijacking Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Request Tracker CVE-2015-1464 Session Hijacking Vulnerability

References:

• 4.2.10 Release Notes (bestpractical)
  
• Request Tracker Home Page (bestpractical)
  
• Debian alert DSA-3176-1 (request-tracker4) (lwn)