Kernel/Modules/AgentTicketWatcher.pm in Open Ticket Request System (OTRS) 3.0.x before 3.0.21, 3.1.x before 3.1.17, and 3.2.x before 3.2.8 does not properly restrict tickets, which allows remote attackers with a valid agent login to read restricted tickets via a crafted URL involving the ticket split mechanism.

The ticket system OTRS was updated to 3.1.18 to fix various bugs and security issues.

Update to 3.1.18 :

  - OSA-2013-05, CVE-2013-4717, CVE-2013-4718 fixed.

  - Fixed bug#9561 - ACL restriction with CustomerID for     DynamicFields at new Ticket screen not working.

  - Fixed bug#9425 - Wrong created date for queue view.

  - Fixed bug#9125 - AgentTicketSearch dialog does not     expand when choosing more search criteria.

  - Fixed bug#8273 - Copying text in preview mode not     possible.

  - Fixed bug#9557 - Cannot see quoted text in customer     ticket zoom.

  - Fixed bug#9011 - GenericInterface: New value after value     mapping can't be 0.

  - Improved parameter quoting in various places.

  - Fixed bug#9104 - Group permission for customer subset     overwrites permissions for other customers.

  - Fixed bug#8719 - PasswordMin2Lower2UpperCharacters     problem.

  - 3.1.17

  - Fixed OSA-2013-04, CVE-2013-4088.

  - Improved permission checks in AgentTicketWatcher.

  - Fixed bug#9503 - no connection header in soap responses.

  - Added parameter '-t dbonly' to backup.pl to only backup     the database

  - Fixed bug#9491 - GenericAgent job update with dynamic     fields sends Uninitialized value error.

  - Fixed bug#9462 - Package Management page timeout due to     HTTPS disabled on Proxy connections.

  - 3.1.16

  - Fixed OSA-2013-03, CVE-2013-3551.

  - Updated Package Manager, that will ensure that packages     to be installed meet the quality standards of OTRS     Group. This is to guarantee that your package     wasn&rsquo;t modified, which may possibly harm your     system or have an influence on the stability and     performance of it. All independent package contributors     will have to conduct a check of their Add-Ons by OTRS     Group in order to take full advantage of the OTRS     package verification.

  - Fixed bug#9387 - Error in a condition with dynamic     fields in NotificationEvent.

  - Fixed bug#9286 - Ticket::ChangeOwnerToEveryone isn't     functional, After a AJAX Load the setting is ignored.

  - Fixed bug#7518 - Escalation Notify by not working     properly (follow-up fix).

  - Fixed bug#7478 - Got an external answer to an internal     mail.

  - Improved permission checks in AgentTicketPhone.

  - Fixed     bug#[9360](http://bugs.otrs.org/show_bug.cgi?id=9360) -     DynamicField Names shown in CSV output.

  - Fixed bug#9384 - Problem with Method ServiceParentsGet     of ServiceObject.

  - Fixed bug#9072 - Reply to email-internal includes     customer users email in Cc. field.

  - 3.1.15

  - Added Malay translation.

  - Fixed bug#8960 - AgentTicketSearch.pm SearchProfile     problem.

  - Fixed bug#9182 - Customer Search Function -> If you go     into a ticket and go back you got not the search     results.

  - Fixed bug#9198 - Linked search with fulltext AND     additional attributes.

  - Fixed bug#9295 - Article dynamic field is not     searchable.

  - Fixed bug#9312 - LinkObject permission check problem.

  - 3.1.14

  - Fixed for OSA-2013-01, CVE-2013-2625.

  - Fixed bug#9257 - No notifications to agents with     out-of-office set but period not reached.

  - Improved permission checks in LinkObject.

  - Fixed bug#9191 - When ticket types are restricted, first     available type is selected in     AgentTicketActionCommon-based screens.

  - Updated Turkish translation, thanks to Sefer     &#x15E;im&#x15F;ek / Network Group!

  - Fixed bug#9214 - IE10: impossible to open links from     rich text articles.

  - Fixed bug#9218 - Cannot use special characters in     TicketHook.

  - Fixed bug#9056 - Unused SysConfig option     Ticket::Frontend::CustomerInfoQueueMaxSize.

  - Follow-up fix for bug#8533 apache will not start on     Fedora.

  - Fixed bug#9172 - Generic Interface does not work on IIS     7.0.

  - Updated Czech language translation, thanks to Katerina     Bubenickova!

  - Fixed bug#8865 - Additional empty data column in     statistics CSV-Output.

  - update OTRS::ITSM to 3.1.10 (fix for OSA-2013-05,     CVE-2013-4717, CVE-2013-4718)

  - update OTRS::ITSM to 3.1.9 (fix for OSA-2013-03,     CVE-2013-3551)

  - update OTRS::ITSM to 3.1.8 (fix for OSA-2013-01,     CVE-2013-2625) (fix for OSA-2013-02, CVE-2013-2637)

  - update to 3.1.13

  - http://www.otrs.com/en/open-source/community-news/releases-notes/ release-notes-otrs-help-desk-3113/

  - http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.2260.2.206&view=markup

  - Fixed bug#9162 - Setting the start day of the week for     the datepicker to Sunday does not work.

  - Fixed bug#9141 - Confused Columns in     CustomerTicketSearch (ResultShort).

  - Fixed bug#9146 - Signed SMIME mails with altered content     shows a not clear message.

  - Fixed bug#9145 - SMIME sign verification errors are not     displayed in TicketZoom.

  - Fixed bug#9140 - Postmaster Filter for empty subjects     does not work.

  - Fixed bug#9121 - Filenames with Unicode NFD are     incorrectly reported as NFC by Main::DirectoryRead().

  - Fixed bug#9108 - Check for opened/closed tickets not     working with Ticket::SubjectFormat = Right.

  - Fixed bug#8839 - DateChecksum followup doesn't get     correctly SystemID.

  - Updated Russian translation, thanks to Vadim Goncharov!

  - Fixed bug#9101 - Not possible to create dropdown with     autocomplete attribute.

  - Fixed bug#9096 - All services list is shown instead of     only default services.

  - Fixed bug#8470 - otrs.GenericAgent.pl reports: Can't     open     '/opt/otrs/otrs_vemco/var/tmp/CacheFileStorable/DynamicF     ield/f3b7e10730fb6c9cab5ae0e7f7e034f3'.

  - Added new translation for Spanish (Colombia), thanks to     John Edisson Ortiz Roman!

  - Fixed bug#9054 - Link Object deletes all links under     certain conditions.

  - Fixed bug#8944 - do not backup the cache.

  - Fixed bug#9057 - Generating a PDF with     bin/otrs.GenerateStats.pl produces lots of warnings.

  - Fixed bug#8929 - Fix problems with empty ticket search     results while     Ticket::Frontend::AgentTicketSearch###ExtendedSearchCond     ition is inactive.

  - Fixed bug#9042 - Add X-Spam-Score to Ticket.xml.

  - Fixed bug#9047 - HistoryTicketGet caches info on disk     directly.

  - Fixed bug#8923 - Alert message shown, if parent window     is reloaded while bulk action popup is open.

  - Fixed bug#9030 - Wrong handling of Invalid YAML in     Scheduler Tasks.

  - Updated CKEditor to version 3.6.6.

  - Updated Polish translation, thanks to Pawel @ ib.pl!

  - Follow-up fix for bug#8805 - Cron missing as RPM     dependency on RHEL. Changed dependency on 'anacron' to     'vixie-cron' on RHEL5.

  - Fixed bug#9020 - Generic Ticket Connector does not     support attachments with ContentType without charset.

  - Fixed bug#8545 - Attachment download not possible if pop     up of another action is open.

  - Fixed bug#9009 - Empty Multiselect Dynamic Fields     provokes an error.

  - Fixed bug#8589 - Bulk-Action not possible for single     ticket.

  - Fixed bug#7198 - Broken repository selection width in     Package Manager.

  - Fixed bug#8457 - Error if accessing AgentTicketSearch     from AgentTicketPhone in IE8.

  - Fixed bug#8695 - Table head of Customer Ticket History     does not resize on window resize.

  - Fixed bug#8533 - Apache will not start if you use     mod_perl on Fedora 16 or 17.

  - Fixed bug#8974 - Event Based Notification does not     populate REALNAME with Customer User data.

  - update to 3.1.12

  - Fixed bug#8933 - ArticleStorageInit permission check     problem.

  - Fixed bug#8763 - Please add charset conversion for     customer companies.

  - Fixed bug#1970 - Email attachments of type .msg     (Outlook-Message) are converted.

  - Fixed bug#8955 - Init script might fail on SUSE.

  - Fixed bug#8936 - Ticket close date is empty when ticket     is created in closed state.

  - Fixed bug#8937 - '$' should be escaped in interpolated     strings when JavaScript is meant.

  - Fixed bug#8919 - Customer interface search results:
    ticket can only be accessed via ticket number and     subject.

  - Fixed bug#8850 - CustomerTicketOverview - MouseOver Age     isn't always correct.

  - Fixed bug#8868 - Event Based Notification problem saving     'text' Dynamic Fields.

  - Fixed bug#8914 - Syntax error in hash loop in TicketGet     operation.

  - Fixed bug#8749 - CustomerFrontend: missing dynamicfield     in search results.

  - Fixed bug#8873 - Bad example of customization of     'static' dynamic fields in AgentTicketOverviewSmall.

  - Fixed bug#8791 - IMAPTLS fails with some Microsoft     Exchange servers.

  - Fixed bug#8841 - Search for Dynamic Fields shows all     tickets (on 'enter' key pressed).

  - Fixed bug#8861 - Ticket History overlaid calender choice     function.

  - Fixed bug#8862 - GI debugger GUI does not show SOAP XML     tags correctly.

  - Fixed bug#8566 - Cannot download attachment if filename     has character #.

  - Fixed bug#8833 - Article table in TicketZoom does not     scroll correctly.

  - Fixed bug#8673 - Richtext-Editor popups broken on     Customer-Interface.

  - Fixed bug#8859 - Package upgrade does not work if an     installed testpackage should be upgraded with a newer     regular package.

  - Fixed bug#8678 - 'WidgetAction Toggle' is always shown     as 'Expanded' when nesting elements

  - Fixed bug#8378 - Validation fails if the ID of the     element contains a dot (.) or a colon (:)

  - Fixed bug#8847 - Inline PGP message description routine     does not add any info, thanks to IB Development Team.

  - Fixed bug#8848 - AgentTicketEmail does not preserve PGP     Signatures set if attachment is added.

  - Fixed bug#8149 - Wrong handling of subject when     SubjectFormat=right.

  - Updated Polish translation, thanks to Pawel!

  - Fixed bug#8820 - Service rcotrs restart fails because a     race condition happens.

  - Fixed bug#8819 - Syntax error (stop crontab command) in     SuSE rc script.

  - Removed auto cleanup of expired sessions in     CreateSessionID() to improve the scalability of the hole     system.

  - Fixed bug#8667 - TicketSplit does not use QueueID of old     Ticket for ACL Checking.

  - Fixed bug#8780 - 508 Compliance: Text descriptions of     'Responsible Tickets' and 'Locked Tickets' links are     insufficient for screen reader users.

  - Fixed bug#8812 - Encrypted email doesn't see properly in     Outlook.

  - Fixed bug#8214 - OTRS Init script on Red Hat fails to     check scheduler.

  - Fixed bug#8850 - Cron missing as RPM dependency on Red     Hat Enterprise Linux.

  - Fixed bug#7274 - Ticket QueueView sorts by priority on     first page but subsequent pages sort incorrectly by Age.

  - Fixed bug#8792 - TriggerEscalationStopEvents logs as     loglevel 'error'.

  - Fixed bug#8743 - AgentTicketCompose.pm creates To, CC,     BCC filelds without spaces after comma.

  - Fixed bug#8606 - Escalation notifications should not be     sent to agents who are set out-of-office.

  - Fixed bug#8740 - backup.pl: insufficient handling of     system() return values.

  - Fixed bug#8622 - Storing a new GI Invoker or Operation     with an existing name doesn't complain anything.

  - Fixed bug#8770 - AJAX Removes Default Options (follow-up     fix).

  - Improved caching for Services and Service Lists.

  - Update ITSM to 3.1.7

  - News

  - In AgentTicketZoom the service and the sla are now shown     as links to the service zoom / sla zoom screens.

  - Updated Polish translation, thanks to Pawel!

  - Added feature in bin/otrs.ITSMConfigItemDelete.pl script     to delete config items by class together with the     deployment state.

  - Added CustomerCompany field type that allows to link     CI's with Customer Companies registered in OTRS.

  - Enhanced Import/Export screen to show a summary after     importing.

  - Added new optional sysconfig option to check if config     item names are unique.

  - Added attachment support for ITSM config items. This     will replace the OTRS FeatureAddOn OTRSCIAttachment.
    Please uninstall this FeatureAddon BEFORE you upgrade to     OTRS::ITSM 3.1.7 (no attachment data will be lost)!

  - Bug Fixes

  - Bug# 5928 - Print PDF: Newline not interpreted.

  - Bug# 8723 - Setting the planned start and planned end     time to the same value causes an error.

  - Bug# 8785 - Poor performance of ServiceGet with many     child services.

  - Bug# 8626 - AgentTicketAddtlITSMField, Ticket states set     to first state after reload.

  - Bug# 8852 - No Impact and Criticality in     CustomerTicketZoom.

  - Bug# 7786 - Search by 'type' not displaying correct     results from page 2 on.

  - Bug# 8804 - Reorder of workorders based on actual     startime.

  - Bug# 8686 - CI-Search can not handle > 1000 CIs per     class

  - Bug# 8863 - Problem with ChangeManagement DropDowns in     Conditions Mask.

  - Bug# 8834 - Broken changes created from template when no     time offset.

  - Bug# 8830 - CI version header should be clickable in all     columns.

  - Bug# 8613 - Wrong date if a workorder has been created     from a template.

  - Bug# 8881 - Searching for a config item number = 0 or a     config item name = 0 (without wildcards) finds results     where it should not.

  - Bug# 8882 - Error message from ToolBarMyCAB.

  - Bug# 8614 - Update agent notification doesn't contain     agent name.

  - Bug# 8615 - Notification not sent for ChangeStateUpdate     to pending PIR.

  - Bug# 7508 - Autocomplete uses milliseconds rather than     seconds.

  - rebase perm patch

  - fix changes file

Updated otrs package fixes security vulnerabilities :

An attacker with a valid agent login could manipulate URLs in the ticket watch mechanism to see contents of tickets they are not permitted to see (CVE-2013-3551, CVE-2013-4088).

The OTRS Project reports :

An attacker with a valid agent login could manipulate URLs in the ticket watch mechanism to see contents of tickets they are not permitted to see.

It was discovered that users with a valid agent login could use crafted URLs to bypass access control restrictions and read tickets to which they should not have access.

The oldstable distribution (squeeze) is not affected by this problem.

ID	Name	Product	Family	Severity
75111	openSUSE Security Update : otrs (openSUSE-SU-2013:1338-1)	Nessus	SuSE Local Security Checks	medium
67133	Mandriva Linux Security Advisory : otrs (MDVSA-2013:188)	Nessus	Mandriva Local Security Checks	medium
66938	FreeBSD : otrs -- information disclosure (8b97d289-d8cf-11e2-a1f5-60a44c524f57)	Nessus	FreeBSD Local Security Checks	medium
66937	Debian DSA-2712-1 : otrs2 - privilege escalation	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2013-4088

medium

Tenable Plugins

medium

medium

medium

medium