Test ID:	1.3.6.1.4.1.25623.1.0.58348
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-1298-1)
Summary:	The remote host is missing an update for the Debian 'otrs2' package(s) announced via the DSA-1298-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'otrs2' package(s) announced via the DSA-1298-1 advisory. Vulnerability Insight: It was discovered that the Open Ticket Request System performs insufficient input sanitising for the Subaction parameter, which allows the injection of arbitrary web script code. The oldstable distribution (sarge) doesn't include otrs2. For the stable distribution (etch) this problem has been fixed in version 2.0.4p01-18. The unstable distribution (sid) isn't affected by this problem. We recommend that you upgrade your otrs2 package. Affected Software/OS: 'otrs2' package(s) on Debian 4. Solution: Please install the updated package(s). CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2007-2524 BugTraq ID: 23862 http://www.securityfocus.com/bid/23862 Bugtraq: 20070507 OTRS <= 2.0.x XSS/XSRF (Google Search) http://www.securityfocus.com/archive/1/467870/100/0/threaded Bugtraq: 20070611 Re: [SECURITY] [DSA 1299-1] New ipsec-tools packages fix denial ofservice (Google Search) http://www.securityfocus.com/archive/1/471192/100/0/threaded Debian Security Information: DSA-1298 (Google Search) http://www.debian.org/security/2007/dsa-1298 http://www.virtuax.be/?page=library&id=35&type=Exploits http://osvdb.org/35821 http://osvdb.org/35822 http://secunia.com/advisories/25205 http://secunia.com/advisories/25419 http://secunia.com/advisories/25787 http://securityreason.com/securityalert/2668 SuSE Security Announcement: SUSE-SR:2007:013 (Google Search) http://www.novell.com/linux/security/advisories/2007_13_sr.html http://www.vupen.com/english/advisories/2007/1698 XForce ISS Database: otrs-indexpl-xss(34164) https://exchange.xforce.ibmcloud.com/vulnerabilities/34164
Copyright	Copyright (C) 2008 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.