[rt-users] [Rt-announce] Security vulnerability in RT 3.0 and up

[Alex Vandiver]

All versions of RT from 3.0.0 to 3.6.6 (including some, but not all RT
3.7 development releases) are vulnerable to a potential remote denial
of service attack which could exhaust virtual memory or consume all
available CPU resources.  After a detailed analysis, we believe that
an attacker would need to be a 'Privileged' RT user in order to
perform an attack.

We recommend that you install version 1.19 or newer of the Perl module
Devel::StackTrace from CPAN, which will close the vulnerability.  Two
methods for doing this are:

* Using the CPAN shell - as root, run the following:

       # cpan Devel::StackTrace

* Download and install the package by hand - as root, run the
  following:

       # wget http://www.cpan.org/authors/id/D/DR/DROLSKY/Devel-StackTrace-1.1901.tar.gz
       # tar xvzf Devel-StackTrace-1.1901.tar.gz
       # cd Devel-StackTrace-1.1901
       # perl Makefile.PL
       # make
       # make test
       # make install

Installing this newer version of the module is a complete fix, and
will close the vulnerability.  However, we suggest that you upgrade to
RT 3.6.7, released last Monday, which provides additional safeguards
against this type of attack.

We wish to thank Rune Hammersland <rune.hammersland at hig.no> for
bringing this issue to our attention in a diligent and professional
manner, and to Dave Rolsky <autarch at urth.org> for working with us to
resolve the issue in the libraries that RT uses.

If you need help resolving this issue locally, we will provide
significantly discounted pricing for single-incident support.  Please
contact us at sales at bestpractical.com for more information.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 197 bytes
Desc: This is a digitally signed message part
URL: <http://lists.bestpractical.com/pipermail/rt-users/attachments/20080623/2ecdd2d3/attachment-0001.sig>
-------------- next part --------------
_______________________________________________
RT-Announce mailing list
RT-Announce at lists.bestpractical.com
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-announce