BID:14200

Bugzilla Summary and Title Unauthorized Access Vulnerability

Info

Bugzilla Summary and Title Unauthorized Access Vulnerability

Bugtraq ID:	14200
Class:	Race Condition Error
CVE:	CVE-2005-2174
Remote:	Yes
Local:	No
Published:	Jul 08 2005 12:00AM
Updated:	Jul 12 2009 04:06PM
Credit:	The individual or individuals responsible for the discovery of this issue are currently unknown; the vendor disclosed this issue.
Vulnerable:	Mozilla Bugzilla 2.19.3 Mozilla Bugzilla 2.19.2 Mozilla Bugzilla 2.19.1 Mozilla Bugzilla 2.18.1 Mozilla Bugzilla 2.18 rc3 Mozilla Bugzilla 2.18 rc2 Mozilla Bugzilla 2.18 rc1 Mozilla Bugzilla 2.17.7 Mozilla Bugzilla 2.17.6 Mozilla Bugzilla 2.17.5 Mozilla Bugzilla 2.17.4 Mozilla Bugzilla 2.17.3 Mozilla Bugzilla 2.17.1 Gentoo Linux

Not Vulnerable:	Mozilla Bugzilla 2.20 rc1 Mozilla Bugzilla 2.18.2

Discussion

Bugzilla Summary and Title Unauthorized Access Vulnerability

Bugzilla is prone to an unauthorized access vulnerability.

An attacker could exploit this vulnerability to retrieve the summary, and on slower machines the title of the newly added bug entry. Information obtained may aid in other attacks against the system detailed in the bug entry.

Exploit / POC

Bugzilla Summary and Title Unauthorized Access Vulnerability

No exploit is required.

Solution / Fix

Bugzilla Summary and Title Unauthorized Access Vulnerability

Solution:
The vendor has addressed this issue in the stable Bugzilla version 2.18.2; earlier versions are reported vulnerable. Users of the development snapshot should upgrade to the latest candidate release 2.20rc1.

Gentoo has released security advisory GLSA 200507-12 addressing this issue. Gentoo recommends all Bugzilla users should upgrade to the latest available version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=www-apps/bugzilla-2.18.3"

Mozilla Bugzilla 2.17.1