Session Fixation Vulnerability in RT versions before 3.8.6

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

In late September, a customer contacted us to report a session fixation
vulnerability in RT 3.8.5 and all earlier versions back to and including
RT 3.0.0.  Over the course of the past month, we've worked to develop
and release a version of RT not vulnerable to this issue as well as a
"hot patch" to earlier versions of RT which eliminates the vulnerability
with minimal code changes.  RT 3.8.6, released on October 19th, is _not_
vulnerable.

We have been assigned CVE number CVE-2009-3585 for this issue.

This issue could allow a malicious attacker who can operate a server in
the same domain (example.com where RT is rt.example.com) to obtain and
redistribute an RT session identifier to an unsuspecting user before
they log into RT.  When that user logs in, the attacker would then be
able to hijack the user's session.

As part of an internal audit of the session handling code, we found and
fixed an additional, related vulnerability which could allow an attacker
with HTTP access to the RT server to construct a similar attack without
the need for a server within the same domain.

If you are using an external auth source (such as apache) you are
not vulnerable to this attack.  This only applies to RT's built-in
$WebExternalAuth setting.  RT-Authen-ExternalAuth does not protect you
from this attack.

I have attached six patches which should cover all vulnerable versions
of RT 3.  RT 3.6.10 will be released later today and will include a
version of this patch.  As mentioned before, RT 3.8.6 is _not_ vulnerable.

The SHA1s of patches are:
38e0a8ce3480807a5dd6cc4da0eb51183382cddd  RT-3.0.0-session_fixation.v3.patch
de22a6e67d7d9d163a392d92530818f3d28e0af2  RT-3.0.1-3.0.6-session_fixation.v3.patch
03fb855a449393ef93db67b800d396bdbfb38a8f  RT-3.0.7-3.6.1-session_fixation.v3.patch
7e5acff213a735894663f63fac90c95089a5e5d1  RT-3.6.2-3.6.3-session_fixation.v3.patch
9c60e647c848e35cea5a6ffe36bdd1f0a355c91f  RT-3.6.4-3.6.9-session_fixation.v2.patch
ada53ca94fdb4db3b185a7e14405d5a9ef76017f  RT-3.8-session_fixation.patch

RT 3.0.0

 $ cd /opt/rt3/share
 $ patch -p1 < /path/to/RT-3.0.0-session_fixation.v3.patch

RT 3.0.1-3.0.6

 $ cd /opt/rt3/share
 $ patch -p1 < /path/to/RT-3.0.1-3.0.6-session_fixation.v3.patch

RT 3.0.7-3.6.1

 $ cd /opt/rt3/share
 $ patch -p1 < /path/to/RT-3.0.7-3.6.1-session_fixation.v3.patch


RT 3.6.2-3.6.3

 $ cd /opt/rt3/share
 $ patch -p1 < RT-3.6.2-3.6.3-session_fixation.v3.patch

RT 3.6.4-3.6.9

 $ cd /opt/rt3/share
 $ patch -p1 < RT-3.6.4-3.6.9-session_fixation.v2.patch

RT 3.8.0-3.8.5

 $ cd /opt/rt3/share
 $ patch -p1 < /path/to/RT-3.8-session_fixation.patch

You should then clear your mason cache. If your RT is installed in /opt/rt3, you
would use this command:

 $ rm -rf /opt/rt3/var/mason_data/obj/*

and restart your webserver, this is often accomplished with

 $ /etc/init.d/httpd restart
   (or)
 $ /etc/init.d/apache restart

I apologize for any inconvenience that this issue may have caused you. 
We go to great lengths to make sure that RT is robust and secure, but, 
as with any software, occasionally we do find defects.  We do our best 
to deal with them quickly and responsibly.

I'd like to thank Mikal Gule and the University of Oslo for bringing
this issue to our attention and working with us to triage it and test
the patches included below.  I'd also like to thank Thomas Goetz, who
also brought a variant of this issue to our attention.

If you require assistance evaluating whether your RT deployment is
vulnerable to this issue or deploying the patch, please don't hesitate to
contact us at sales@bestpractical.com.  While we're not able to provide
commercial support without charge, we'll make every effort to provide
help for this issue as quickly and as inexpensively as possible.

Best,

Jesse Vincent
Best Practical
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEUEARECAAYFAksT+WcACgkQEi9d9xCOQEafCwCYpvl6m0W0W/VQnFhzr8jwHdfX
dgCcDO6fi1XudFJc3jKYowci1VoqwxU=
=cI4e
-----END PGP SIGNATURE-----

Download RT-3.0.0-session_fixation.v3

Download RT-3.0.1-3.0.6-session_fixation.v3 

Download RT-3.0.7-3.6.1-session_fixation.v3 

Download RT-3.6.2-3.6.3-session_fixation.v3 

Download RT-3.6.4-3.6.9-session_fixation.v2 

Download RT-3.8-session_fixation

Comments

[Netzen Solutions Ltd]

Nice Work,

I am about to install RT on Debian / Ubuntu, does that mean the .deb in the deb repos is still vulnerable?

If so I will make a patch!

[Jesse]

No, we worked with the debian folks to make sure they released an
update to RT with the security fix as we announced the vulnerability.