CVE-2013-3368 bin/rt in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with predictable name.
LowCVSS 3.3
EPSS 0.35%
- Published
- Updated
- Exploit status
- No public exploit known
Description
bin/rt in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with predictable name.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/request-tracker4(Debian:12) | < 4.0.12-2 | 4.0.12-2 |
| bestpractical rt | = 4.0.0 | No fix listed |
| bestpractical rt | = 4.0.0-rc1 | No fix listed |
| bestpractical rt | = 4.0.0-rc2 | No fix listed |
| bestpractical rt | = 4.0.0-rc3 | No fix listed |
| bestpractical rt | = 4.0.0-rc4 | No fix listed |
| bestpractical rt | = 4.0.0-rc5 | No fix listed |
| bestpractical rt | = 4.0.0-rc6 | No fix listed |
| bestpractical rt | = 4.0.0-rc7 | No fix listed |
| bestpractical rt | = 4.0.0-rc8 | No fix listed |
| bestpractical rt | = 4.0.1 | No fix listed |
| bestpractical rt | = 4.0.1-rc1 | No fix listed |
| bestpractical rt | = 4.0.1-rc2 | No fix listed |
| bestpractical rt | = 4.0.2 | No fix listed |
| bestpractical rt | = 4.0.2-rc1 | No fix listed |
| bestpractical rt | = 4.0.2-rc2 | No fix listed |
| bestpractical rt | = 4.0.3 | No fix listed |
| bestpractical rt | = 4.0.3-rc1 | No fix listed |
| bestpractical rt | = 4.0.3-rc2 | No fix listed |
| bestpractical rt | = 4.0.4 | No fix listed |
| bestpractical rt | = 4.0.5 | No fix listed |
| bestpractical rt | = 4.0.5-rc1 | No fix listed |
| bestpractical rt | = 4.0.6 | No fix listed |
| bestpractical rt | = 4.0.7 | No fix listed |
| bestpractical rt | = 4.0.7-rc1 | No fix listed |
Show 53 more
| Product | Affected versions | Fixed in |
|---|---|---|
| bestpractical rt | = 4.0.8 | No fix listed |
| bestpractical rt | = 4.0.8-rc1 | No fix listed |
| bestpractical rt | = 4.0.8-rc2 | No fix listed |
| bestpractical rt | = 4.0.9 | No fix listed |
| bestpractical rt | = 4.0.10 | No fix listed |
| bestpractical rt | = 4.0.11 | No fix listed |
| bestpractical rt | = 4.0.12 | No fix listed |
| bestpractical rt | = 3.8.0 | No fix listed |
| bestpractical rt | = 3.8.0-preflight1 | No fix listed |
| bestpractical rt | = 3.8.0-rc1 | No fix listed |
| bestpractical rt | = 3.8.0-rc2 | No fix listed |
| bestpractical rt | = 3.8.0-rc3 | No fix listed |
| bestpractical rt | = 3.8.1 | No fix listed |
| bestpractical rt | = 3.8.1-preflight0 | No fix listed |
| bestpractical rt | = 3.8.1-rc1 | No fix listed |
| bestpractical rt | = 3.8.1-rc2 | No fix listed |
| bestpractical rt | = 3.8.1-rc3 | No fix listed |
| bestpractical rt | = 3.8.1-rc4 | No fix listed |
| bestpractical rt | = 3.8.1-rc5 | No fix listed |
| bestpractical rt | = 3.8.2 | No fix listed |
| bestpractical rt | = 3.8.2-rc1 | No fix listed |
| bestpractical rt | = 3.8.2-rc2 | No fix listed |
| bestpractical rt | = 3.8.3 | No fix listed |
| bestpractical rt | = 3.8.3-rc1 | No fix listed |
| bestpractical rt | = 3.8.3-rc2 | No fix listed |
| bestpractical rt | = 3.8.4 | No fix listed |
| bestpractical rt | = 3.8.4-rc1 | No fix listed |
| bestpractical rt | = 3.8.5 | No fix listed |
| bestpractical rt | = 3.8.6 | No fix listed |
| bestpractical rt | = 3.8.6-rc1 | No fix listed |
| bestpractical rt | = 3.8.7 | No fix listed |
| bestpractical rt | = 3.8.7-rc1 | No fix listed |
| bestpractical rt | = 3.8.8 | No fix listed |
| bestpractical rt | = 3.8.8-rc2 | No fix listed |
| bestpractical rt | = 3.8.8-rc3 | No fix listed |
| bestpractical rt | = 3.8.8-rc4 | No fix listed |
| bestpractical rt | = 3.8.9 | No fix listed |
| bestpractical rt | = 3.8.9-rc1 | No fix listed |
| bestpractical rt | = 3.8.9-rc2 | No fix listed |
| bestpractical rt | = 3.8.9-rc3 | No fix listed |
| bestpractical rt | = 3.8.10 | No fix listed |
| bestpractical rt | = 3.8.10-rc1 | No fix listed |
| bestpractical rt | = 3.8.11 | No fix listed |
| bestpractical rt | = 3.8.11-rc1 | No fix listed |
| bestpractical rt | = 3.8.11-rc2 | No fix listed |
| bestpractical rt | = 3.8.12 | No fix listed |
| bestpractical rt | = 3.8.13 | No fix listed |
| bestpractical rt | = 3.8.13-rc1 | No fix listed |
| bestpractical rt | = 3.8.13-rc2 | No fix listed |
| bestpractical rt | = 3.8.14 | No fix listed |
| bestpractical rt | = 3.8.14-rc1 | No fix listed |
| bestpractical rt | = 3.8.15 | No fix listed |
| bestpractical rt | = 3.8.16 | No fix listed |
References
- Debian Security Tracker CVE-2013-3368 vendor-advisory
- [rt-announce] 20130522 Security vulnerabilities in RT mailing-list patch
- [rt-announce] 20130522 RT 4.0.13 released mailing-list patch
- [rt-announce] 20130522 RT 3.8.17 released mailing-list patch
- 53505 third-party-advisory vendor-advisory
- 53522 third-party-advisory vendor-advisory
- DSA-2670 vendor-advisory
- 93612 vdb-entry
- bugs.debian.org issue-tracking