In Open Ticket Request System (OTRS) 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS system. If a logged in user opens it, the email could cause the browser to load external image or CSS resources.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Open Ticket Request System (OTRS) 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an     attacker could send a malicious email to an OTRS system. If a logged in user opens it, the email could     cause the browser to load external image or CSS resources. (CVE-2018-16586)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for otrs to version 4.0.32 fixes the following issues :

These security issues were fixed :

  - CVE-2018-16586: An attacker could have sent a malicious     email to an OTRS system. If a logged in user opens it,     the email could have caused the browser to load external     image or CSS resources (bsc#1109822).

  - CVE-2018-16587: An attacker could have sent a malicious     email to an OTRS system. If a user with admin     permissions opens it, it caused deletions of arbitrary     files that the OTRS web server user has write access to     (bsc#1109823).

  - CVE-2018-14593: An attacker who is logged into OTRS as     an agent may have escalated their privileges by     accessing a specially crafted URL (bsc#1103800).

These non-security issues were fixed :

  - fixed permissions file @OTRS_ROOT@/var/tmp ->     @OTRS_ROOT@/var/tmp/

  - ACL for Action AgentTicketBulk were inconsistent.

Three vulnerabilities were discovered in the Open Ticket Request System which could result in privilege escalation or denial of service.

Fabien Arnoux discovered several security issues in email validation of otrs system.

CVE-2018-16586

Load external image or CSS resources in browser when user opens a malicious email.

CVE-2018-16587

Remote deletions of arbitrary files that the OTRS web server user has write access when opening malicious email.

For Debian 8 'Jessie', these problems have been fixed in version 3.3.18-1+deb8u6.

We recommend that you upgrade your otrs2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
257822	Linux Distros Unpatched Vulnerability : CVE-2018-16586	Nessus	Misc.	medium
123320	openSUSE Security Update : otrs (openSUSE-2019-748)	Nessus	SuSE Local Security Checks	high
118099	Debian DSA-4317-1 : otrs2 - security update	Nessus	Debian Local Security Checks	high
117931	openSUSE Security Update : otrs (openSUSE-2018-1106)	Nessus	SuSE Local Security Checks	high
117714	Debian DLA-1521-1 : otrs2 security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2018-16586

medium

Tenable Plugins

medium

high

high

high

medium