RT 3.4/3.6 possible mail loop issue. Patch Attached

Jesse Vincent <[email protected]> Wed, 14 Mar 2007 13:24:40 -0400
Newsgroups gmane.comp.bug-tracking.request-tracker.announce
Message-ID <[email protected]> 
In certain circumstances, a malicious (or incompetent) remote  
attacker can coax an RT 3.4.6 or 3.6.3 instance into getting into a  
mail loop with itself. Earlier releases may also be affected.

This vulnerability ONLY affects RT instances that have been  
configured to restrict email creation of new tickets to users with  
known accounts. Best Practical generally recommends that sites  
configure RT somewhat more "openly," though we do support this  
configuration.

The attached patch, which will be included in RT 3.6.4 and RT 3.4.7,  
has resolved this issue in our testing and for the end user who  
reported the issue.  Community-provided help with this and other RT- 
related issues is available via [email protected], our  
free and open RT support mailing list.

If you need professional assistance with this or any other RT-related  
issue, please don't hesitate to contact us at [email protected].

We're indebted to Eric Jacksch of Tenebris Technologies Inc. for his  
initial report of this issue and his help while we performed triage  
and developed a solution.

Best,

Jesse Vincent
President
Best Practical Solutions, LLC

_______________________________________________
RT-Announce mailing list
[email protected]
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-announce
rt-3.4-and-3.6-mail-loop-fix.patch (application/octet-stream, 1.5 KB) 
=== lib/RT/Interface/Email.pm
==================================================================
--- lib/RT/Interface/Email.pm	(revision 48337)
+++ lib/RT/Interface/Email.pm	(local)
@@ -570,6 +570,15 @@
     #Pull apart the subject line
     my $Subject = $head->get('Subject') || '';
     chomp $Subject;
+    
+    # {{{ Lets check for mail loops of various sorts.
+    my ($message_is_not_machine_generated, $result);
+     ( $message_is_not_machine_generated, $ErrorsTo, $result ) = _HandleMachineGeneratedMail(
+        Message  => $Message,
+        ErrorsTo => $ErrorsTo,
+        Subject  => $Subject,
+        MessageId => $MessageId
+    );
 
     $args{'ticket'} ||= ParseTicketId($Subject);
 
@@ -685,16 +694,8 @@
         );
     }
 
-    # {{{ Lets check for mail loops of various sorts.
-    my ($continue, $result);
-     ( $continue, $ErrorsTo, $result ) = _HandleMachineGeneratedMail(
-        Message  => $Message,
-        ErrorsTo => $ErrorsTo,
-        Subject  => $Subject,
-        MessageId => $MessageId
-    );
 
-    unless ($continue) {
+    unless ($message_is_not_machine_generated) {
         return ( 0, $result, undef );
     }
     
@@ -862,6 +863,7 @@
     );
 
     # Also notify the requestor that his request has been dropped.
+    if ($args{'Requestor'} ne $RT::OwnerEmail) {
     MailError(
         To          => $args{'Requestor'},
         Subject     => "Could not load a valid user",
@@ -873,6 +875,7 @@
         MIMEObj  => $args{'Message'},
         LogLevel => 'error'
     );
+    }
 }
 
 =head2 _HandleMachineGeneratedMail
PGP.sig (application/pgp-signature, 186 B) - not displayed