-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

              ESB-2005.0943 -- OTRS Security Advisory 2005-01
   Vulnerabilities in OTRS core / SQL-Injection and Cross-Site-Scripting
                             24 November 2005

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           OTRS 2.0.3 and prior
                   OTRS 1.3.2 and prior
Publisher:         OTRS Security Team
Operating System:  UNIX variants
                   Windows
Impact:            Execute Arbitrary Code/Commands
                   Cross-site Scripting
Access:            Remote/Unauthenticated

Original Bulletin: 
  http://lists.otrs.org/pipermail/announce/2005/000046.html

- --------------------------BEGIN INCLUDED TEXT--------------------

Subject: [announce] English: [OSA-2005-01] Vulnerabilities in OTRS core / 
         SQL-Injection and Cross-Site-Scripting
From: OTRS Security Team <security at otrs.org>
List: announce
Date: 2005-11-23 08:31:25

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 -----------------------------------------------------------------------
 OTRS Security Advisory 2005-01                      <security at otrs.org>
 -----------------------------------------------------------------------
 ID:         OSA-2005-01
 Date:       2005-11-22
 Title:      Vulnerabilities in OTRS-Core allows
             SQL-Injection and Cross-Site-Scripting
 Severity:   Critical
 Product:    OTRS 2.x, OTRS 1.x
 Fixed in:   OTRS 2.0.4, OTRS 1.3.3
 URL:        http://otrs.org/advisory/OSA-2005-01-en/
 -----------------------------------------------------------------------

This Advisory covers three vulnerabilities in the OTRS-System-Core.


SQL-Injection via UNION

  Missing security quoting for SQL statements allows agents the
  manipulation of SQL queries. So it's possible to inject SQL queries
  via UNION statements.

  A malicious user may be able to login successfully without valid
  credentials. Authentication mechanisms other than the database 
  backend authentication are not affected.

  Authenticated users can use this vulnerabilitiy to get records from
  other OTRS database tables. This informations can be used for
  other attacks like session hijacking.

Open attachment in new browser window

  In default config setting OTRS opens attachments in new browser
  windows if an agent clicks on the download symbole.

  An attacker can exploit this vulnerabilitiy by sending manipulated
  attachments with active script content which will be executed by
  the browser with user privileges.

Input fields allows injection of script code

  Missing HTML quoting allows an agent in a valid session the
  injection of HTML tags.

  This vulnerability allows an attacker to inject script code
  into the OTRS webinterface which will be loaded and executed
  in users browsers.


Affected by these vulnerabilities are all releases of OTRS 2.x up
to and including 2.0.3 and all releases of OTRS 1.x up to and
including 1.3.2.

These vulnerabilities are fixed in OTRS 2.0.4 and OTRS 1.3.3.

Fixed OTRS releases can be found at:

 o ftp://ftp.otrs.org/

As a workaround for vulnerability #2 it's possible to disable the
'open attachments in a browser window' feature by changing the
config setting "AttachmentDownloadType = attachment".

Please send informations regarding vulnerabilities in OTRS to
<security at otrs.org>. Many thanks to Moritz Naumann (Naumann IT
Consulting & Services) for discover this vulnerabilities.

Copyright (c) OTRS GmbH, <http://otrs.org/>


- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)

iD8DBQFDhBkOuBqJltZnEl4RAoS0AKCCdj6hxEPsR6r8OPGSB0I8aLW9KwCfR84d
Lo/mj+BeK9SD9F82VRPKOP8=
=ylGb
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBQ4VAUyh9+71yA2DNAQLyTgQAg47E2GNET3VVDP73X8Fsqfxr1Kqj0HKK
5s4kWvpOBD73y7wz1GWxGOn7vI1nbi37TXT42PzdK1aPasrZ6cWCpGSz+jHRzwEj
97NdXKfTxfrxsoMlBPdgYA5yngaZg07vt2IVFdxLJ2dILMtHf1NJw62pKSmnN1Gd
VMWnirFpBco=
=QaPs
-----END PGP SIGNATURE-----