February 2010 - announce - OTRS mailing lists

OTRS Security Advisory 2010-01: OTRS 2.4.7 (Aitutaki Beach)
by Hauke Böttcher 07 Feb '10

07 Feb '10

Dear Community Members, ++++++++++ OTRS Security Advisory 2010-01 OTRS 2.4.7 ++++++++++ Release: OTRS 2.4.7 Status: stable Code Name: Aitutaki Beach SECURITY FIXES: =============== --------------------------------------------------------------- OTRS Security Advisory 2010-01 <security(a)otrs.org> --------------------------------------------------------------- ID: OSA-2010-01 Date: 2010-02-08 Title: Vulnerability in OTRS-Core allows SQL-Injection Severity: Critical Product: OTRS 2.4.x, OTRS 2.3.x, OTRS 2.2.x, OTRS 2.1.x Fixed in: OTRS 2.4.7, OTRS 2.3.5, OTRS 2.2.9, OTRS 2.1.9 URL: http://otrs.org/advisory/OSA-2010-01-en/ CVE: CVE-2010-0438 --------------------------------------------------------------- To read the entire Security Advisory please follow this link: ENGLISH VERSION: http://otrs.org/advisory/OSA-2010-01-en/ GERMAN VERSION: http://otrs.org/advisory/OSA-2010-01-de/ BUG FIXES: ========== * Bug# 4754 - Multiple tickets get created with a huge POP3 Mailbox - more then 2000 email in the box. Error message: ("Deep recursion on subroutine"). [ http://bugs.otrs.org/show_bug.cgi?id=4754 ] * Bug# 4770 - Attachments are stripped/not shown from outgoing emails in some scenarios with ms exchange. [ http://bugs.otrs.org/show_bug.cgi?id=4770 ] * Bug# 4735 - TicketFreeTime option in Customer frontend for ticket search does not work as expected (only every second is used). [ http://bugs.otrs.org/show_bug.cgi?id=4735 ] * Bug# 4818 - Removed inline image of forwarded message and composing answers in agent interface are still included. [ http://bugs.otrs.org/show_bug.cgi?id=4818 ] MD5 CHECKSUMS: ============== b0bc7d2135431694e515515aedcb021c http://ftp.otrs.org/pub/otrs/RPMS/suse/7.3/otrs-2.4.7-01.noarch.rpm 15a26ee60b17b871b315e816c0634dfa http://ftp.otrs.org/pub/otrs/RPMS/suse/8.x/otrs-2.4.7-01.noarch.rpm 9688f2c41f03d59ea69beb8f8705c28f http://ftp.otrs.org/pub/otrs/RPMS/suse/9.0/otrs-2.4.7-01.noarch.rpm 24ce79ad1abf3ee7b3a1727af8833de9 http://ftp.otrs.org/pub/otrs/RPMS/suse/9.1/otrs-2.4.7-01.noarch.rpm fe310dd5c0d0bb800dccc1e970afeaa9 http://ftp.otrs.org/pub/otrs/RPMS/suse/10.0/otrs-2.4.7-01.noarch.rpm 64d6f67049c4b147601545460f3d9897 http://ftp.otrs.org/pub/otrs/RPMS/suse/11.0/otrs-2.4.7-01.noarch.rpm 578070ba8ddf62074eab0f43d17d5d3d http://ftp.otrs.org/pub/otrs/RPMS/fedora/4/otrs-2.4.7-01.noarch.rpm df273a147c9313ce8a4e46098131ab2b http://ftp.otrs.org/pub/otrs/RPMS/redhat/7.x/otrs-2.4.7-01.noarch.rpm 6e02958ff98d56e09c36730852fe6dfe http://ftp.otrs.org/pub/otrs/RPMS/redhat/8.0/otrs-2.4.7-01.noarch.rpm 1295255918f32150b35b73df1afd0b0c http://ftp.otrs.org/pub/otrs/otrs-2.4.7.tar.gz d233b500ec996c00b284ce1d241ea172 http://ftp.otrs.org/pub/otrs/otrs-2.4.7.tar.bz2 f786229c8410435fd57630235d2fad24 http://ftp.otrs.org/pub/otrs/otrs-2.4.7.zip 0663b2e320f49eced27cd19e9de4b268 http://ftp.otrs.org/pub/otrs/otrs-2.4.7-win-installer-2.1.1.exe 9440d68226f51a7b345132d25a11f1e3 http://ftp.otrs.org/pub/otrs/otrs-2.4.7-win-installer-2.2.0beta7.exe DOWNLOAD FIXED RELEASES: ======================== http://otrs.org/releases/ YOUR CONTRIBUTION: =================== * Please send information regarding vulnerabilities in OTRS to security(a)otrs.org. * We kindly ask for your assistance to update the translation files! The current status can be found here: http://users.otrs.com/~me/i18n/ FEEDBACK & BUG REPORTING: ========================= Although OTRS 2.4.7 has been tested before, we appreciate your contributions. As always, you’re encouraged to tell us what you think, using this feedback e-Mail: [enjoy at otrs.com] or by filing a bug in Bugzilla [http://bugs.otrs.org]. MEET US: ======== CU@ PINK - 14th. IT Service Management Conference in Las Vegas (USA) and get to know more about OTRS at booth no. 517b from Feb 21-24, 2010! CU@ CeBIT 2010 in Hannover (Germany) and get to know more about OTRS at booth no. C37, in hall 2 from March 2.-6., 2010! -- ((enjoy)) Hauke Jan Böttcher Director Sales & Marketing OTRS AG Norsk-Data-Straße 1 61352 Bad Homburg Germany T: +49 (0) 6172 681988 0 F: +49 (0) 9421 56818 18 I: http://www.otrs.com/ Business Location: Bad Homburg Country Court: Bad Homburg, HRB 10751 VAT ID: DE256610065 Chairman: Burchard Steinbild Managing Board: André Mindermann (CEO)

1 0

OTRS Security Advisory 2010-01: OTRS 2.3.5 (Bora Bora)
by Hauke Böttcher 07 Feb '10

07 Feb '10

Dear Community Members, ++++++++++ OTRS Security Advisory 2010-01 OTRS 2.3.5 ++++++++++ Release: OTRS 2.3.5 Status: stable Code Name: Bora Bora SECURITY FIXES: =============== --------------------------------------------------------------- OTRS Security Advisory 2010-01 <security(a)otrs.org> --------------------------------------------------------------- ID: OSA-2010-01 Date: 2010-02-08 Title: Vulnerability in OTRS-Core allows SQL-Injection Severity: Critical Product: OTRS 2.4.x, OTRS 2.3.x, OTRS 2.2.x, OTRS 2.1.x Fixed in: OTRS 2.4.7, OTRS 2.3.5, OTRS 2.2.9, OTRS 2.1.9 URL: http://otrs.org/advisory/OSA-2010-01-en/ CVE: CVE-2010-0438 --------------------------------------------------------------- To read the entire Security Advisory please follow this link: ENGLISH VERSION: http://otrs.org/advisory/OSA-2010-01-en/ GERMAN VERSION: http://otrs.org/advisory/OSA-2010-01-de/ BUG FIXES: ========== * Bug# 3573 - Deleting tickets on PostgreSQL 8.3.0 fails. [ http://bugs.otrs.org/show_bug.cgi?id=3573 ] * Bug# 3404 - PendingJobs.pl doesn't unlock the closed tickets. [ http://bugs.otrs.org/show_bug.cgi?id=3404 ] * Bug# 3137 - Ticket search does not work with words like "BPX" and "new". [ http://bugs.otrs.org/show_bug.cgi?id=3137 ] * Bug# 3745 - German umlaut in customer login_id breaks login. [ http://bugs.otrs.org/show_bug.cgi?id=3745 ] MD5 CHECKSUMS: ============== 8709ced8e72d8108da8ef7d512b5a042 http://ftp.otrs.org/pub/otrs/RPMS/suse/7.3/otrs-2.3.5-01.i386.rpm f2a4a86545c575140228f34114bfaaca http://ftp.otrs.org/pub/otrs/RPMS/suse/8.x/otrs-2.3.5-01.i386.rpm ce2a1c5217702bd9170ea4f0a0869395 http://ftp.otrs.org/pub/otrs/RPMS/suse/9.0/otrs-2.3.5-01.i386.rpm 8f6ca387f28333d96c83d1969128f48d http://ftp.otrs.org/pub/otrs/RPMS/suse/9.1/otrs-2.3.5-01.i386.rpm 3ef3239fb04168d834b553d77123404f http://ftp.otrs.org/pub/otrs/RPMS/suse/10.0/otrs-2.3.5-01.i386.rpm a5720f3aa2813b89921bb490e6f35e0a http://ftp.otrs.org/pub/otrs/RPMS/redhat/7.x/otrs-2.3.5-01.i386.rpm 1eac5ea54ba799c52b67ba2156fbe989 http://ftp.otrs.org/pub/otrs/RPMS/redhat/8.0/otrs-2.3.5-01.i386.rpm 519a643a8f58f4403b200a0504ef3fe3 http://ftp.otrs.org/pub/otrs/RPMS/fedora/4/otrs-2.3.5-01.i386.rpm fd5f96d664c98cba19c1d07270ad2287 http://ftp.otrs.org/pub/otrs/otrs-2.3.5.tar.gz c07dcabfb6d001a5cacee71a2a7fc1cf http://ftp.otrs.org/pub/otrs/otrs-2.3.5.tar.bz2 d90a164e4fd4453a4240730fe964514d http://ftp.otrs.org/pub/otrs/otrs-2.3.5.zip 5c2c5e84cf41d556868387c33e56f508 http://ftp.otrs.org/pub/otrs/otrs-2.3.5-win-installer-2.1.1.exe DOWNLOAD FIXED RELEASES: ======================== http://otrs.org/releases/ YOUR CONTRIBUTION: =================== * Please send information regarding vulnerabilities in OTRS to security(a)otrs.org. * We kindly ask for your assistance to update the translation files! The current status can be found here: http://users.otrs.com/~me/i18n/ FEEDBACK & BUG REPORTING: ========================= Although OTRS 2.3.5 has been tested before, we appreciate your contributions. As always, you’re encouraged to tell us what you think, using this feedback e-Mail: [enjoy at otrs.com] or by filing a bug in Bugzilla [http://bugs.otrs.org]. MEET US: ======== CU@ PINK - 14th. IT Service Management Conference in Las Vegas (USA) and get to know more about OTRS at booth no. 517b from Feb 21-24, 2010! CU@ CeBIT 2010 in Hannover (Germany) and get to know more about OTRS at booth no. C37, in hall 2 from March 2.-6., 2010! -- ((enjoy)) Hauke Jan Böttcher Director Sales & Marketing OTRS AG Norsk-Data-Straße 1 61352 Bad Homburg Germany T: +49 (0) 6172 681988 0 F: +49 (0) 9421 56818 18 I: http://www.otrs.com/ Business Location: Bad Homburg Country Court: Bad Homburg, HRB 10751 VAT ID: DE256610065 Chairman: Burchard Steinbild Managing Board: André Mindermann (CEO)

1 0

OTRS Security Advisory 2010-01: OTRS 2.2.9 (Ipanema)
by Hauke Böttcher 07 Feb '10

07 Feb '10

Dear Community Members, ++++++++++ OTRS Security Advisory 2010-01 OTRS 2.2.9 ++++++++++ Release: OTRS 2.2.9 Status: stable Code Name: Ipanema SECURITY FIXES: =============== --------------------------------------------------------------- OTRS Security Advisory 2010-01 <security(a)otrs.org> --------------------------------------------------------------- ID: OSA-2010-01 Date: 2010-02-08 Title: Vulnerability in OTRS-Core allows SQL-Injection Severity: Critical Product: OTRS 2.4.x, OTRS 2.3.x, OTRS 2.2.x, OTRS 2.1.x Fixed in: OTRS 2.4.7, OTRS 2.3.5, OTRS 2.2.9, OTRS 2.1.9 URL: http://otrs.org/advisory/OSA-2010-01-en/ CVE: CVE-2010-0438 --------------------------------------------------------------- To read the entire Security Advisory please follow this link: ENGLISH VERSION: http://otrs.org/advisory/OSA-2010-01-en/ GERMAN VERSION: http://otrs.org/advisory/OSA-2010-01-de/ MD5 CHECKSUMS: ============== be262a6005c315f036703f8505846212 http://ftp.otrs.org/pub/otrs/RPMS/suse/7.3/otrs-2.2.9-01.noarch.rpm 14b801622514951698dea9320145c1b1 http://ftp.otrs.org/pub/otrs/RPMS/suse/8.x/otrs-2.2.9-01.noarch.rpm 11d6086f7356933e1104e039c7d25418 http://ftp.otrs.org/pub/otrs/RPMS/suse/9.0/otrs-2.2.9-01.noarch.rpm b68be271262800112536c8e7df50fe06 http://ftp.otrs.org/pub/otrs/RPMS/suse/9.1/otrs-2.2.9-01.noarch.rpm 937fa0f653c424b03a4036be86d7936a http://ftp.otrs.org/pub/otrs/RPMS/suse/10.0/otrs-2.2.9-01.noarch.rpm 0b6620074ce3907b956adecf795e7367 http://ftp.otrs.org/pub/otrs/RPMS/redhat/7.x/otrs-2.2.9-01.noarch.rpm dc6aef34ad102b088879330696ea5be6 http://ftp.otrs.org/pub/otrs/RPMS/redhat/8.0/otrs-2.2.9-01.noarch.rpm ca118c6fa218b23736745b09a4ff76b5 http://ftp.otrs.org/pub/otrs/RPMS/fedora/4/otrs-2.2.9-01.noarch.rpm 9ae3e3531e88667185ef154c2e7b0044 http://ftp.otrs.org/pub/otrs/otrs-2.2.9.tar.gz 9d5bcbf90a08878589b41dd70ab44258 http://ftp.otrs.org/pub/otrs/otrs-2.2.9.tar.bz2 99849327935ae309e39dbc41cce2ea21 http://ftp.otrs.org/pub/otrs/otrs-2.2.9.zip 5c2c5e84cf41d556868387c33e56f508 http://ftp.otrs.org/pub/otrs/otrs-2.2.9-win-installer-2.1.1.exe DOWNLOAD FIXED RELEASES: ======================== http://otrs.org/releases/ YOUR CONTRIBUTION: =================== * Please send information regarding vulnerabilities in OTRS to security(a)otrs.org. * We kindly ask for your assistance to update the translation files! The current status can be found here: http://users.otrs.com/~me/i18n/ FEEDBACK & BUG REPORTING: ========================= Although OTRS 2.2.9 has been tested before, we appreciate your contributions. As always, you’re encouraged to tell us what you think, using this feedback e-Mail: [enjoy at otrs.com] or by filing a bug in Bugzilla [http://bugs.otrs.org]. MEET US: ======== CU@ PINK - 14th. IT Service Management Conference in Las Vegas (USA) and get to know more about OTRS at booth no. 517b from Feb 21-24, 2010! CU@ CeBIT 2010 in Hannover (Germany) and get to know more about OTRS at booth no. C37, in hall 2 from March 2.-6., 2010! -- ((enjoy)) Hauke Jan Böttcher Director Sales & Marketing OTRS AG Norsk-Data-Straße 1 61352 Bad Homburg Germany T: +49 (0) 6172 681988 0 F: +49 (0) 9421 56818 18 I: http://www.otrs.com/ Business Location: Bad Homburg Country Court: Bad Homburg, HRB 10751 VAT ID: DE256610065 Chairman: Burchard Steinbild Managing Board: André Mindermann (CEO)

1 0

OTRS Security Advisory 2010-01: OTRS 2.1.9 (Playa Esmeralda)
by Hauke Böttcher 07 Feb '10

07 Feb '10

Dear Community Members, ++++++++++ OTRS Security Advisory 2010-01 OTRS 2.1.9 ++++++++++ Release: OTRS 2.1.9 Status: stable Code Name: Playa Esmeralda SECURITY FIXES: =============== --------------------------------------------------------------- OTRS Security Advisory 2010-01 <security(a)otrs.org> --------------------------------------------------------------- ID: OSA-2010-01 Date: 2010-02-08 Title: Vulnerability in OTRS-Core allows SQL-Injection Severity: Critical Product: OTRS 2.4.x, OTRS 2.3.x, OTRS 2.2.x, OTRS 2.1.x Fixed in: OTRS 2.4.7, OTRS 2.3.5, OTRS 2.2.9, OTRS 2.1.9 URL: http://otrs.org/advisory/OSA-2010-01-en/ CVE: CVE-2010-0438 --------------------------------------------------------------- To read the entire Security Advisory please follow this link: ENGLISH VERSION: http://otrs.org/advisory/OSA-2010-01-en/ GERMAN VERSION: http://otrs.org/advisory/OSA-2010-01-de/ BUG FIXES: ========== * Bug# 2491 - OTRS crashes after initial login on fresh installation on perl 5.10. [ http://bugs.otrs.org/show_bug.cgi?id=2491 ] MD5 CHECKSUMS: ============== dec0657db6cd3a627ee6a206f9c1a168 http://ftp.otrs.org/pub/otrs/RPMS/suse/7.3/otrs-2.1.9-01.i386.rpm 5393d405232abe1a4017f339587f41ec http://ftp.otrs.org/pub/otrs/RPMS/suse/8.x/otrs-2.1.9-01.i386.rpm 76c0f6343ad639a1f599263d7b1ce8c0 http://ftp.otrs.org/pub/otrs/RPMS/suse/9.0/otrs-2.1.9-01.i386.rpm eb3388eb5e36644033958e45aa745f95 http://ftp.otrs.org/pub/otrs/RPMS/suse/9.1/otrs-2.1.9-01.i386.rpm 44fadc2919c733ec3e7bae1aea26fb07 http://ftp.otrs.org/pub/otrs/RPMS/suse/10.0/otrs-2.1.9-01.i386.rpm 8df01a19a8e9f0d35d3cf2c79d184f44 http://ftp.otrs.org/pub/otrs/RPMS/redhat/7.x/otrs-2.1.9-01.i386.rpm 40626e5734c43e9fb4b247563c2c4b29 http://ftp.otrs.org/pub/otrs/RPMS/redhat/8.0/otrs-2.1.9-01.i386.rpm 433cde4c5b2781fd3749e58fb1aed084 http://ftp.otrs.org/pub/otrs/RPMS/fedora/4/otrs-2.1.9-01.i386.rpm 3585a3f7397a5e0607f02cd0fc4187ab http://ftp.otrs.org/pub/otrs/otrs-2.1.9.tar.gz 83238bb68b14de4ceea7910c3efc9c00 http://ftp.otrs.org/pub/otrs/otrs-2.1.9.tar.bz2 dd1351534a5a3308ce9932808551dadb http://ftp.otrs.org/pub/otrs/otrs-2.1.9-win-installer-2.1.1.exe DOWNLOAD FIXED RELEASES: ======================== http://otrs.org/releases/ YOUR CONTRIBUTION: =================== * Please send information regarding vulnerabilities in OTRS to security(a)otrs.org. * We kindly ask for your assistance to update the translation files! The current status can be found here: http://users.otrs.com/~me/i18n/ FEEDBACK & BUG REPORTING: ========================= Although OTRS 2.1.9 has been tested before, we appreciate your contributions. As always, you’re encouraged to tell us what you think, using this feedback e-Mail: [enjoy at otrs.com] or by filing a bug in Bugzilla [http://bugs.otrs.org]. MEET US: ======== CU@ PINK - 14th. IT Service Management Conference in Las Vegas (USA) and get to know more about OTRS at booth no. 517b from Feb 21-24, 2010! CU@ CeBIT 2010 in Hannover (Germany) and get to know more about OTRS at booth no. C37, in hall 2 from March 2.-6., 2010! -- ((enjoy)) Hauke Jan Böttcher Director Sales & Marketing OTRS AG Norsk-Data-Straße 1 61352 Bad Homburg Germany T: +49 (0) 6172 681988 0 F: +49 (0) 9421 56818 18 I: http://www.otrs.com/ Business Location: Bad Homburg Country Court: Bad Homburg, HRB 10751 VAT ID: DE256610065 Chairman: Burchard Steinbild Managing Board: André Mindermann (CEO)

1 0

Release Note OTRS::ITSM 2.0 - Change Management
by Hauke Böttcher 01 Feb '10

01 Feb '10

Dear Community Members, +++++++++++++++++++++++++ RELEASE NOTE ++++++++++++++++++++++++ Release: OTRS::ITSM 2.0 + NEW Change Management Status: beta1 Code Name: Whitehaven Beach, Australia Required Framework: OTRS 2.4.6 Code Name: Aitutaki Beach, Cook Island OTRS::ITSM is the world's leading open-source ITIL-compatible IT Service Management solution. It is built on the solid fundament of 70,000 productive OTRS installations which is available in 27 languages. All known features from OTRS continue to be available in OTRS::ITSM. Using the OTRS package manager you can easily expand your existing Service Desk solution OTRS to a powerful IT Service Management Suite by installing additional ITIL processes: * Incident Management * Problem Management * Service Asset & Configuration Management incl. CMDB/CMS * Knowledge Management * Service Request Fulfillment Management * Service Level Management AND..... Touchdown! - The new CHANGE MANAGEMENT module has been success- fully and exclusively released to the group of investors who supported the realization by their investments. How to become a CHANGE MANAGEMENT user: ======================================= Change Management, the next ITIL process to be implemented in the OTRS::ITSM standard is now ready for use. OTRS::ITSM 2.0 including the new Change Management module will be provided to 'investors' only until the funding covers the remaining 50% of total investment. There are 55,000 EUR left to be covered until OTRS::ITSM 2.0 and its new module Change Management will be published to all of you. It will be available under the AGPL and for sure remain free of any license fees. If your organization is interested in joining the initiative and get the Change Management right from the start please contact us: ready-for-take-off at otrs.com Join in and get ready for take-off! ENHANCEMENTS: ============ * Added brand new ITSM Change Management module! * Speed: Improved speed of CMDB/CMS by switching database access technology (now SQL bind parameters are used). * Events: Implemented new ITSM-global Event module to create ability to react on CI events, as well as all kind of Change and Work Order events (e.g. ChangeUpdate, WorkOrderUpdate) * History: Added Event module to have a history of CI changes * GeneralCatalog: Implemented "Preferences" to have an extendable mechanism to store meta information for GC entries * ITSMConfigurationManagement: Added an access control system for config item classes and config items. Via GeneralCatalog groups can be specified that have access to config item classes. Users with 'ro' permissions can see the class and view the config item, users with 'rw' permission can add new config items in this class and edit existing items. * Added Chinese Simple translation, thanks to Never Min! BUG FIXES: ========== * Bug# 4196 - Create new CI version only when a value was changed. [ http://bugs.otrs.org/show_bug.cgi?id=4196 ] * Bug# 4382 - Memory leak in OTRS::ITSM modules. Under some circumstances OTRS::ITSM could use too much memory over time. [ http://bugs.otrs.org/show_bug.cgi?id=4196 ] * Bug# 4376 - Unusable/Defect Back-Link on CI Linkpage. [ http://bugs.otrs.org/show_bug.cgi?id=4196 ] * Bug# 3813 - When linking services to CIs only the short name was shown. [ http://bugs.otrs.org/show_bug.cgi?id=4196 ] * Bug# 4768 - Editing some sub-elements of a Configuration Item was not possible. [ http://bugs.otrs.org/show_bug.cgi?id=4196 ] KNOWN ISSUES: ============= * Bug# 4845 - Problem with Templates and Umlauts in Change and Work Order Text fields. [ http://bugs.otrs.org/show_bug.cgi?id=4845 ] * Bug# 4854 - CPAN Module Date::PCalc is missing. [ http://bugs.otrs.org/show_bug.cgi?id=4854 ] DOWNLOAD: ========= As this is still an 'exclusive' release which is available to investors only OTRS::ITSM 2.0 including the Change Management module can not be downloaded yet. But, why don't you become an investor to CHANGE that! ;-) MEET US: ======== CU@ PINK - 14th. IT Service Management Conference in Las Vegas (USA) and get to know more about OTRS at booth no. 517b from Feb 21-24, 2010! CU@ CeBIT 2010 in Hannover (Germany) and get to know more about OTRS at booth no. C37, in hall 2 from March 2.-6., 2010! -- ((enjoy)) Hauke Jan Böttcher Director Sales & Marketing OTRS AG Norsk-Data-Straße 1 61352 Bad Homburg Germany T: +49 (0) 6172 681988 0 F: +49 (0) 9421 56818 18 I: http://www.otrs.com/ Business Location: Bad Homburg Country Court: Bad Homburg, HRB 10751 VAT ID: DE256610065 Chairman: Burchard Steinbild Managing Board: André Mindermann (CEO)

1 0