[Rt-announce] SECURITY - Session Fixation Vulnerability in RT 3.0.0-3.8.5

[Jesse Vincent]

In late September, a customer contacted us to report a session fixation
vulnerability in RT 3.8.5 and all earlier versions back to and including
RT 3.0.0.  Over the course of the past month, we've worked to develop
and release a version of RT not vulnerable to this issue as well as a
"hot patch" to earlier versions of RT which eliminates the vulnerability
with minimal code changes.  RT 3.8.6, released on October 19th, is _not_
vulnerable.

We have been assigned CVE number CVE-2009-3585 for this issue.

This issue could allow a malicious attacker who can operate a server in
the same domain (example.com where RT is rt.example.com) to obtain and
redistribute an RT session identifier to an unsuspecting user before
they log into RT.  When that user logs in, the attacker would then be
able to hijack the user's session.

As part of an internal audit of the session handling code, we found and
fixed an additional, related vulnerability which could allow an attacker
with HTTP access to the RT server to construct a similar attack without
the need for a server within the same domain.

If you are using RT's $WebExternalAuth configuration variable, you are
not vulnerable to this issue (but should still apply this patch).
If you are using the RT extension "RT-Authen-ExternalAuth", you must apply
this patch. RT-Authen-ExternalAuth does NOT protect you from this
vulnerability.

I have attached six patches which should cover all vulnerable versions
of RT 3.  RT 3.6.10 will be released later today and will include a
version of this patch.  As mentioned before, RT 3.8.6 is _not_ vulnerable.

The SHA1s of patches are:
38e0a8ce3480807a5dd6cc4da0eb51183382cddd  RT-3.0.0-session_fixation.v3.patch
de22a6e67d7d9d163a392d92530818f3d28e0af2  RT-3.0.1-3.0.6-session_fixation.v3.patch
03fb855a449393ef93db67b800d396bdbfb38a8f  RT-3.0.7-3.6.1-session_fixation.v3.patch
7e5acff213a735894663f63fac90c95089a5e5d1  RT-3.6.2-3.6.3-session_fixation.v3.patch
9c60e647c848e35cea5a6ffe36bdd1f0a355c91f  RT-3.6.4-3.6.9-session_fixation.v2.patch
ada53ca94fdb4db3b185a7e14405d5a9ef76017f  RT-3.8-session_fixation.patch

RT 3.0.0

 $ cd /opt/rt3/share
 $ patch -p1 < /path/to/RT-3.0.0-session_fixation.v3.patch

RT 3.0.1-3.0.6

 $ cd /opt/rt3/share
 $ patch -p1 < /path/to/RT-3.0.1-3.0.6-session_fixation.v3.patch

RT 3.0.7-3.6.1

 $ cd /opt/rt3/share
 $ patch -p1 < /path/to/RT-3.0.7-3.6.1-session_fixation.v3.patch


RT 3.6.2-3.6.3

 $ cd /opt/rt3/share
 $ patch -p1 < RT-3.6.2-3.6.3-session_fixation.v3.patch

RT 3.6.4-3.6.9

 $ cd /opt/rt3/share
 $ patch -p1 < RT-3.6.4-3.6.9-session_fixation.v2.patch

RT 3.8.0-3.8.5

 $ cd /opt/rt3/share
 $ patch -p1 < /path/to/RT-3.8-session_fixation.patch

You should then clear your mason cache. If your RT is installed in
/opt/rt3, you would use this command:

 $ rm -rf /opt/rt3/var/mason_data/obj/*

and restart your webserver, this is often accomplished with

 $ /etc/init.d/httpd restart
   (or)
 $ /etc/init.d/apache restart

I apologize for any inconvenience that this issue may have caused you.
We go to great lengths to make sure that RT is robust and secure, but,
as with any software, occasionally we do find defects.  We do our best
to deal with them quickly and responsibly.

I'd like to thank Mikal Gule and the University of Oslo for bringing
this issue to our attention and working with us to triage it and test
the patches included below.  I'd also like to thank Thomas Goetz, who
also brought a variant of this issue to our attention.

If you require assistance evaluating whether your RT deployment is
vulnerable to this issue or deploying the patch, please don't hesitate to
contact us at sales at bestpractical.com.  While we're not able to provide
commercial support without charge, we'll make every effort to provide
help for this issue as quickly and as inexpensively as possible.

Best,

Jesse Vincent
Best Practical
-------------- next part --------------
A non-text attachment was scrubbed...
Name: RT-3.0.0-session_fixation.v3.patch
Type: text/x-diff
Size: 1367 bytes
Desc: not available
Url : http://lists.bestpractical.com/pipermail/rt-announce/attachments/20091130/c06e2efe/attachment.patch 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: RT-3.0.1-3.0.6-session_fixation.v3.patch
Type: text/x-diff
Size: 1796 bytes
Desc: not available
Url : http://lists.bestpractical.com/pipermail/rt-announce/attachments/20091130/c06e2efe/attachment-0001.patch 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: RT-3.0.7-3.6.1-session_fixation.v3.patch
Type: text/x-diff
Size: 1819 bytes
Desc: not available
Url : http://lists.bestpractical.com/pipermail/rt-announce/attachments/20091130/c06e2efe/attachment-0002.patch 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: RT-3.8-session_fixation.patch
Type: text/x-diff
Size: 1007 bytes
Desc: not available
Url : http://lists.bestpractical.com/pipermail/rt-announce/attachments/20091130/c06e2efe/attachment-0003.patch 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: RT-3.6.2-3.6.3-session_fixation.v3.patch
Type: text/x-diff
Size: 1226 bytes
Desc: not available
Url : http://lists.bestpractical.com/pipermail/rt-announce/attachments/20091130/c06e2efe/attachment-0004.patch 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: RT-3.6.4-3.6.9-session_fixation.v2.patch
Type: text/x-diff
Size: 996 bytes
Desc: not available
Url : http://lists.bestpractical.com/pipermail/rt-announce/attachments/20091130/c06e2efe/attachment-0005.patch 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: Digital signature
Url : http://lists.bestpractical.com/pipermail/rt-announce/attachments/20091130/c06e2efe/attachment.pgp