BugZilla Process_Bug.CGI Restricted Bug Comments Revealing Vulnerability
BID:3258
Info
BugZilla Process_Bug.CGI Restricted Bug Comments Revealing Vulnerability
| Bugtraq ID: | 3258 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 29 2001 12:00AM |
| Updated: | Aug 29 2001 12:00AM |
| Credit: | This vulnerability was announced in a Bugzilla Security Advisory dated August 29, 2001. |
| Vulnerable: |
Mozilla Bugzilla 2.12 Mozilla Bugzilla 2.10 Mozilla Bugzilla 2.8 |
| Not Vulnerable: | |
Discussion
BugZilla Process_Bug.CGI Restricted Bug Comments Revealing Vulnerability
Bugzilla is the bug tracking software package by the Mozilla project.
A problem in Bugzilla has been discovered that allows remote users to gain access to restricted bug information. Upon viewing a restricted bug, the user may save the show_bug.cgi page, and monitor the hidden form fields to the following:
<INPUT TYPE=HIDDEN NAME="delta_ts" VALUE="19950000000000">
<INPUT TYPE=HIDDEN NAME="longdesclength" VALUE="0">
<INPUT TYPE=HIDDEN NAME="id" VALUE=bugid>
Loading this modified page, and clicking commit yields the comments.
Bugzilla is the bug tracking software package by the Mozilla project.
A problem in Bugzilla has been discovered that allows remote users to gain access to restricted bug information. Upon viewing a restricted bug, the user may save the show_bug.cgi page, and monitor the hidden form fields to the following:
<INPUT TYPE=HIDDEN NAME="delta_ts" VALUE="19950000000000">
<INPUT TYPE=HIDDEN NAME="longdesclength" VALUE="0">
<INPUT TYPE=HIDDEN NAME="id" VALUE=bugid>
Loading this modified page, and clicking commit yields the comments.