Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 544
Alerts This Week
Warning Icon 1 544

Debian DSA-2261-1 Critical: Redmine Remote Access And XSS Risk

debian
Calendar Grey June 15, 2011
Scroller Debian
Uncover the Debian Security Bulletin DSA-2261-1, which outlines security flaws within Redmine that could jeopardize user information.
Joernchen of Phenoelit discovered several vulnerabilities in Redmine, a project management web application: Logged in users may be able to access private data
Topics%20covered

Topics Covered

security advisory debian cross site scripting remote access redmine

Summary

Logged in users may be able to access private data.

The Textile formatter allowed for cross site scripting, exposing
sensitive data to an attacker.

The Bazaar repository adapter could be used to remotely execute
commands on the host running Redmine.

The oldstable distribution (lenny) does not contain redmine packages.

For the stable distribution (squeeze), this problem has been fixed in
version 1.0.1-2.

For the testing distribution (wheezy) and unstable distribution (sid),
this problem has been fixed in version 1.0.5-1.

We recommend that you upgrade your redmine packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/



Severity
critical
Lowest
Low
Medium
High
Critical

Topics%20covered

Topics Covered

security advisory debian cross site scripting remote access redmine

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.