CVE-2008-7278 Information

Description

The S/MIME feature in Open Ticket Request System (OTRS) before 2.2.5 and 2.3.x before 2.3.0-beta1 does not properly configure the RANDFILE environment variable for OpenSSL which might make it easier for remote attackers to decrypt e-mail messages that had lower than intended entropy available for cryptographic operations related to inability to write to the seeding file.

Reference

http://bugs.otrs.org/show_bug.cgi?id=2539 http://bugs.otrs.org/show_bug.cgi?id=2844 http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807