Bugzilla Hidden Product Information Disclosure Vulnerability

Bugtraq ID:	13606
Class:	Access Validation Error
CVE:	CVE-2005-1563 CVE-2005-1565
Remote:	Yes
Local:	No
Published:	May 12 2005 12:00AM
Updated:	Jul 06 2016 02:40PM
Credit:	Discovered by Frédéric Buclin <[email protected]>.
Vulnerable:	Mozilla Bugzilla 2.19.2 Mozilla Bugzilla 2.19.1 Mozilla Bugzilla 2.18 rc3 Mozilla Bugzilla 2.18 rc2 Mozilla Bugzilla 2.18 rc1 Mozilla Bugzilla 2.17.7 Mozilla Bugzilla 2.17.6 Mozilla Bugzilla 2.17.5 Mozilla Bugzilla 2.17.4 Mozilla Bugzilla 2.17.3 Mozilla Bugzilla 2.17.1 Mozilla Bugzilla 2.17 Mozilla Bugzilla 2.16.7 + Conectiva Linux 10.0 + Conectiva Linux 9.0 + Conectiva Linux 9.0 + Conectiva Linux 9.0 + Conectiva Linux 9.0 Mozilla Bugzilla 2.16.6 Mozilla Bugzilla 2.16.5 Mozilla Bugzilla 2.16.4 Mozilla Bugzilla 2.16.3 Mozilla Bugzilla 2.16.2 + Conectiva Linux 9.0 + Conectiva Linux 9.0 Mozilla Bugzilla 2.16.1 Mozilla Bugzilla 2.16 - Mandriva Linux Mandrake 9.0 - Mandriva Linux Mandrake 9.0 Mozilla Bugzilla 2.14.5 Mozilla Bugzilla 2.14.4 Mozilla Bugzilla 2.14.3 Mozilla Bugzilla 2.14.2 + Debian Linux 3.0 sparc + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 s/390 + Debian Linux 3.0 s/390 + Debian Linux 3.0 s/390 + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 ppc + Debian Linux 3.0 ppc + Debian Linux 3.0 ppc + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mipsel + Debian Linux 3.0 mipsel + Debian Linux 3.0 mipsel + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 mips + Debian Linux 3.0 mips + Debian Linux 3.0 mips + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 m68k + Debian Linux 3.0 m68k + Debian Linux 3.0 m68k + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 hppa + Debian Linux 3.0 hppa + Debian Linux 3.0 hppa + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 arm + Debian Linux 3.0 arm + Debian Linux 3.0 arm + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 alpha + Debian Linux 3.0 alpha + Debian Linux 3.0 alpha + Debian Linux 3.0 alpha + Debian Linux 3.0 + Debian Linux 3.0 + Debian Linux 3.0 + Debian Linux 3.0 + Debian Linux 3.0 Mozilla Bugzilla 2.14.1 Mozilla Bugzilla 2.14 - RedHat Linux 7.1 - RedHat Linux 7.1 - RedHat Linux 7.0 - RedHat Linux 7.0 - RedHat Linux 7.0 - RedHat Linux 7.0 - RedHat Linux 7.0 Mozilla Bugzilla 2.12 Mozilla Bugzilla 2.10 Conectiva Linux 10.0
Not Vulnerable:

Bugzilla Hidden Product Information Disclosure Vulnerability

Bugzilla is prone to an information-disclosure vulnerability due to improper access validation. This could allow a user to determine the existence of a product in the Bugzilla database even if it should not be visible to them.

Bugzilla Hidden Product Information Disclosure Vulnerability

An exploit is not required.

Bugzilla Hidden Product Information Disclosure Vulnerability

Solution:
Please see the referenced advisories for details on obtaining and applying the appropriate updates.


Mozilla Bugzilla 2.16

• Mozilla Bugzilla Bug 287109
  2.16 backport, v2
  https://bugzilla.mozilla.org/attachment.cgi?id=182741

Mozilla Bugzilla 2.16.1

• Mozilla Bugzilla Bug 287109
  2.16 backport, v2
  https://bugzilla.mozilla.org/attachment.cgi?id=182741

Mozilla Bugzilla 2.16.2

• Mozilla Bugzilla Bug 287109
  2.16 backport, v2
  https://bugzilla.mozilla.org/attachment.cgi?id=182741

Mozilla Bugzilla 2.16.3

• Mozilla Bugzilla Bug 287109
  2.16 backport, v2
  https://bugzilla.mozilla.org/attachment.cgi?id=182741

Mozilla Bugzilla 2.16.4

• Mozilla Bugzilla Bug 287109
  2.16 backport, v2
  https://bugzilla.mozilla.org/attachment.cgi?id=182741

Mozilla Bugzilla 2.16.5

• Mozilla Bugzilla Bug 287109
  2.16 backport, v2
  https://bugzilla.mozilla.org/attachment.cgi?id=182741

Mozilla Bugzilla 2.16.6

• Mozilla Bugzilla Bug 287109
  2.16 backport, v2
  https://bugzilla.mozilla.org/attachment.cgi?id=182741

Mozilla Bugzilla 2.16.7

• Mozilla Bugzilla Bug 287109
  2.16 backport, v2
  https://bugzilla.mozilla.org/attachment.cgi?id=182741

Mozilla Bugzilla 2.18 rc1

• Mozilla Bugzilla Bug 287109
  2.18 backport, v2
  https://bugzilla.mozilla.org/attachment.cgi?id=182735

Mozilla Bugzilla 2.18 rc3

• Mozilla Bugzilla Bug 287109
  2.18 backport, v2
  https://bugzilla.mozilla.org/attachment.cgi?id=182735

Mozilla Bugzilla 2.18 rc2

• Mozilla Bugzilla Bug 287109
  2.18 backport, v2
  https://bugzilla.mozilla.org/attachment.cgi?id=182735

Mozilla Bugzilla 2.19.1

• Mozilla Bugzilla Bug 287109
  https://bugzilla.mozilla.org/attachment.cgi?id=182124

Mozilla Bugzilla 2.19.2

• Mozilla Bugzilla Bug 287109
  https://bugzilla.mozilla.org/attachment.cgi?id=182124

Bugzilla Hidden Product Information Disclosure Vulnerability

References:

• Bugzilla Bug 287109 (Mozilla)
  
• Bugzilla Homepage (Mozilla)