Debian Reportbug Multiple Information Disclosure Vulnerabilities

Bugtraq ID:	12674
Class:	Configuration Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 28 2005 12:00AM
Updated:	Feb 28 2005 12:00AM
Credit:	Rolf Leggewie is credited with the discovery of these issues.
Vulnerable:	Debian reportbug 2.61 + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia32 + Ubuntu Ubuntu Linux 4.1 ia32 Debian reportbug 2.60
Not Vulnerable:	Debian reportbug 2.62.0 + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia32 + Ubuntu Ubuntu Linux 4.1 ia32

Debian Reportbug Multiple Information Disclosure Vulnerabilities

Multiple information disclosure vulnerabilities affect Debian reportbug; these issues are due to a failure of the application to properly configure sensitive data files.

An attacker may leverage these issues to email smarthost passwords, potentially leading to further compromise.

Debian Reportbug Multiple Information Disclosure Vulnerabilities

No exploit is required to leverage this issue.

Debian Reportbug Multiple Information Disclosure Vulnerabilities

Solution:
Ubuntu Linux has released advisory USN-88-1 dealing with this issue. Please see the referenced advisory for more information.


Debian reportbug 2.60

• Ubuntu reportbug 2.62
  http://security.ubuntu.com/ubuntu/pool/main/r/reportbug/reportbug_2.62 ubuntu1.1_all.deb

Debian reportbug 2.61

• Ubuntu reportbug 2.62
  http://security.ubuntu.com/ubuntu/pool/main/r/reportbug/reportbug_2.62 ubuntu1.1_all.deb

Debian Reportbug Multiple Information Disclosure Vulnerabilities

References: