Bug 1071797 – VUL-0: CVE-2017-16921: otrs: Remote code execution for authenticated users (OSA-2017-09)

Bug 1071797 - (CVE-2017-16921) VUL-0: CVE-2017-16921: otrs: Remote code execution for authenticated users (OSA-2017-09)

(CVE-2017-16921)
Summary:	VUL-0: CVE-2017-16921: otrs: Remote code execution for authenticated users (O...

Status:	RESOLVED INVALID

Classification:	openSUSE
Product:	openSUSE Distribution
Classification:	openSUSE
Component:	Security
Version:	Leap 42.3
Hardware:	Other openSUSE Factory

Priority:	P3 - Medium Severity: Major (vote)
Target Milestone:	---
Assigned To:	Johannes Segitz
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/196328/
Whiteboard:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2017-12-07 16:17 UTC by Johannes Segitz
Modified:	2017-12-16 13:36 UTC (History)
CC List:	0 users

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Johannes Segitz 2017-12-07 16:17:18 UTC

CVE-2017-16921

An attacker who is logged into OTRS as an agent can manipulate form parameters and execute arbitrary shell commands with the permissions of the OTRS or web server user.

https://www.otrs.com/security-advisory-2017-09-security-update-otrs-framework/

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-16921
http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-16921.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16921

Comment 1 Christian Wittmer 2017-12-08 01:32:26 UTC

ongoing work

Comment 2 Christian Wittmer 2017-12-08 02:01:25 UTC

OTRS 3.3 is EOL. No security updates anymore.
User should update to 4.0.x at least.

http://download.opensuse.org/repositories/network:/otrs:/4/

Comment 3 Bernhard Wiedemann 2017-12-08 02:10:05 UTC

This is an autogenerated message for OBS integration:
This bug (1071797) was mentioned in
https://build.opensuse.org/request/show/555150 Factory / otrs

Comment 4 Christian Wittmer 2017-12-16 13:36:57 UTC

An OTRS 5 version is being prepared in network:otrs:Test