BugZilla Show_Activity.CGI Restricted Bug Comments Revealing Vulnerability
BID:3259
Info
BugZilla Show_Activity.CGI Restricted Bug Comments Revealing Vulnerability
| Bugtraq ID: | 3259 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 29 2001 12:00AM |
| Updated: | Aug 29 2001 12:00AM |
| Credit: | This vulnerability was announced in a Bugzilla Security Advisory dated August 29, 2001. |
| Vulnerable: |
Mozilla Bugzilla 2.12 Mozilla Bugzilla 2.10 Mozilla Bugzilla 2.8 |
| Not Vulnerable: | |
Discussion
BugZilla Show_Activity.CGI Restricted Bug Comments Revealing Vulnerability
Bugzilla is the bug tracking software package by the Mozilla project.
It is possible for a remote user to gain access to sensitive bug information through the show_activity.cgi interface. Upon finding a bug that is displayed as restricted through the show_bug.cgi interface, the user may request the bug id through the show_activity.cgi script, which will render the full comments of the bug.
Bugzilla is the bug tracking software package by the Mozilla project.
It is possible for a remote user to gain access to sensitive bug information through the show_activity.cgi interface. Upon finding a bug that is displayed as restricted through the show_bug.cgi interface, the user may request the bug id through the show_activity.cgi script, which will render the full comments of the bug.
Solution / Fix
BugZilla Show_Activity.CGI Restricted Bug Comments Revealing Vulnerability
Solution:
Updates available:
Mozilla Bugzilla 2.10
Mozilla Bugzilla 2.12
Mozilla Bugzilla 2.8
Solution:
Updates available:
Mozilla Bugzilla 2.10
-
Mozilla Bugzilla 2.14
http://ftp.mozilla.org/pub/webtools/bugzilla-2.14.tar.gz -
RedHat 7.0 alpha perl-Chart-0.99c.pre3-1.alpha.rpm
ftp://updates.redhat.com/7.0/en/powertools/alpha/perl-Chart-0.99c.pre3 -1.alpha.rpm -
RedHat 7.0 alpha perl-DBD-MySQL-1.2215-1.alpha.rpm
ftp://updates.redhat.com/7.0/en/powertools/alpha/ -
RedHat 7.0 alpha perl-GD-1.33-1.alpha.rpm
ftp://updates.redhat.com/7.0/en/powertools/alpha/perl-GD-1.33-1.alpha. rpm -
RedHat 7.0 i386 perl-Chart-0.99c.pre3-1.i386.rpm
ftp://updates.redhat.com/7.0/en/powertools/i386/perl-Chart-0.99c.pre3- 1.i386.rpm -
RedHat 7.0 i386 perl-DBD-MySQL-1.2215-1.i386.rpm
ftp://updates.redhat.com/7.0/en/powertools/i386/perl-DBD-MySQL-1.2215- 1.i386.rpm -
RedHat 7.0 i386 perl-GD-1.33-1.i386.rpm
ftp://updates.redhat.com/7.0/en/powertools/i386/perl-GD-1.33-1.i386.rp m -
RedHat 7.0 noarch bugzilla-2.14-1.noarch.rpm
ftp://updates.redhat.com/7.0/en/powertools/noarch/bugzilla-2.14-1.noar ch.rpm -
RedHat 7.1 alpha perl-DBD-MySQL-1.2215-1.alpha.rpm
ftp://updates.redhat.com/7.1/en/powertools/alpha/ -
RedHat 7.1 alpha perl-GD-1.33-1.alpha.rpm
ftp://updates.redhat.com/7.1/en/powertools/alpha/perl-GD-1.33-1.alpha. rpm -
RedHat 7.1 i386 perl-Chart-0.99c.pre3-1.i386.rpm
ftp://updates.redhat.com/7.1/en/powertools/i386/ -
RedHat 7.1 i386 perl-DBD-MySQL-1.2215-1.i386.rpm
ftp://updates.redhat.com/7.1/en/powertools/i386/perl-DBD-MySQL-1.2215- 1.i386.rpm -
RedHat 7.1 i386 perl-GD-1.33-1.i386.rpm
ftp://updates.redhat.com/7.1/en/powertools/i386/perl-GD-1.33-1.i386.rp m -
RedHat 7.1 noarch bugzilla-2.14-1.noarch.rpm
ftp://updates.redhat.com/7.1/en/powertools/noarch/bugzilla-2.14-1.noar ch.rpm
Mozilla Bugzilla 2.12
-
Mozilla Bugzilla 2.14
http://ftp.mozilla.org/pub/webtools/bugzilla-2.14.tar.gz -
RedHat 7.0 alpha perl-Chart-0.99c.pre3-1.alpha.rpm
ftp://updates.redhat.com/7.0/en/powertools/alpha/perl-Chart-0.99c.pre3 -1.alpha.rpm -
RedHat 7.0 alpha perl-DBD-MySQL-1.2215-1.alpha.rpm
ftp://updates.redhat.com/7.0/en/powertools/alpha/ -
RedHat 7.0 alpha perl-GD-1.33-1.alpha.rpm
ftp://updates.redhat.com/7.0/en/powertools/alpha/perl-GD-1.33-1.alpha. rpm -
RedHat 7.0 i386 perl-Chart-0.99c.pre3-1.i386.rpm
ftp://updates.redhat.com/7.0/en/powertools/i386/perl-Chart-0.99c.pre3- 1.i386.rpm -
RedHat 7.0 i386 perl-DBD-MySQL-1.2215-1.i386.rpm
ftp://updates.redhat.com/7.0/en/powertools/i386/perl-DBD-MySQL-1.2215- 1.i386.rpm -
RedHat 7.0 i386 perl-GD-1.33-1.i386.rpm
ftp://updates.redhat.com/7.0/en/powertools/i386/perl-GD-1.33-1.i386.rp m -
RedHat 7.0 noarch bugzilla-2.14-1.noarch.rpm
ftp://updates.redhat.com/7.0/en/powertools/noarch/bugzilla-2.14-1.noar ch.rpm -
RedHat 7.1 alpha perl-DBD-MySQL-1.2215-1.alpha.rpm
ftp://updates.redhat.com/7.1/en/powertools/alpha/ -
RedHat 7.1 alpha perl-GD-1.33-1.alpha.rpm
ftp://updates.redhat.com/7.1/en/powertools/alpha/perl-GD-1.33-1.alpha. rpm -
RedHat 7.1 i386 perl-Chart-0.99c.pre3-1.i386.rpm
ftp://updates.redhat.com/7.1/en/powertools/i386/ -
RedHat 7.1 i386 perl-DBD-MySQL-1.2215-1.i386.rpm
ftp://updates.redhat.com/7.1/en/powertools/i386/perl-DBD-MySQL-1.2215- 1.i386.rpm -
RedHat 7.1 i386 perl-GD-1.33-1.i386.rpm
ftp://updates.redhat.com/7.1/en/powertools/i386/perl-GD-1.33-1.i386.rp m -
RedHat 7.1 noarch bugzilla-2.14-1.noarch.rpm
ftp://updates.redhat.com/7.1/en/powertools/noarch/bugzilla-2.14-1.noar ch.rpm
Mozilla Bugzilla 2.8
-
Mozilla Bugzilla 2.14
http://ftp.mozilla.org/pub/webtools/bugzilla-2.14.tar.gz
References
BugZilla Show_Activity.CGI Restricted Bug Comments Revealing Vulnerability
References:
References: