Bugzilla describecomponents.cgi Arbitrary Bug Viewing Vulnerability
BID:3262
Info
Bugzilla describecomponents.cgi Arbitrary Bug Viewing Vulnerability
| Bugtraq ID: | 3262 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 29 2001 12:00AM |
| Updated: | Aug 29 2001 12:00AM |
| Credit: | This vulnerability was submitted to BugTraq on August 29th, 2001 by David Miller <[email protected]>. |
| Vulnerable: |
Mozilla Bugzilla 2.12 Mozilla Bugzilla 2.10 Mozilla Bugzilla 2.8 Mozilla Bugzilla 2.6 Mozilla Bugzilla 2.4 |
| Not Vulnerable: |
Mozilla Bugzilla 2.14 |
Discussion
Bugzilla describecomponents.cgi Arbitrary Bug Viewing Vulnerability
Bugzilla is a free, open source bug tracking and reporting appplication. It allows users to submit bugs, offers a forum for discussing bugs, keeps track of the status of bugs, and can restrict who has access to bug information.
An error exists in Bugzilla 2.12(and earlier) which will allow an unauthenticated user to view information that they should not have access to. This is done by accessing 'describecomponents.cgi'.
This issue assist in further attacks against the server or network.
Bugzilla is a free, open source bug tracking and reporting appplication. It allows users to submit bugs, offers a forum for discussing bugs, keeps track of the status of bugs, and can restrict who has access to bug information.
An error exists in Bugzilla 2.12(and earlier) which will allow an unauthenticated user to view information that they should not have access to. This is done by accessing 'describecomponents.cgi'.
This issue assist in further attacks against the server or network.
Solution / Fix
Bugzilla describecomponents.cgi Arbitrary Bug Viewing Vulnerability
Solution:
Upgrades available:
Mozilla Bugzilla 2.10
Mozilla Bugzilla 2.12
Mozilla Bugzilla 2.8
Solution:
Upgrades available:
Mozilla Bugzilla 2.10
-
Mozilla Bugzilla 2.14
http://ftp.mozilla.org/pub/webtools/bugzilla-2.14.tar.gz -
RedHat 7.0 alpha perl-Chart-0.99c.pre3-1.alpha.rpm
ftp://updates.redhat.com/7.0/en/powertools/alpha/perl-Chart-0.99c.pre3 -1.alpha.rpm -
RedHat 7.0 alpha perl-DBD-MySQL-1.2215-1.alpha.rpm
ftp://updates.redhat.com/7.0/en/powertools/alpha/ -
RedHat 7.0 alpha perl-GD-1.33-1.alpha.rpm
ftp://updates.redhat.com/7.0/en/powertools/alpha/perl-GD-1.33-1.alpha. rpm -
RedHat 7.0 i386 perl-Chart-0.99c.pre3-1.i386.rpm
ftp://updates.redhat.com/7.0/en/powertools/i386/perl-Chart-0.99c.pre3- 1.i386.rpm -
RedHat 7.0 i386 perl-DBD-MySQL-1.2215-1.i386.rpm
ftp://updates.redhat.com/7.0/en/powertools/i386/perl-DBD-MySQL-1.2215- 1.i386.rpm -
RedHat 7.0 i386 perl-GD-1.33-1.i386.rpm
ftp://updates.redhat.com/7.0/en/powertools/i386/perl-GD-1.33-1.i386.rp m -
RedHat 7.0 noarch bugzilla-2.14-1.noarch.rpm
ftp://updates.redhat.com/7.0/en/powertools/noarch/bugzilla-2.14-1.noar ch.rpm -
RedHat 7.1 alpha perl-DBD-MySQL-1.2215-1.alpha.rpm
ftp://updates.redhat.com/7.1/en/powertools/alpha/ -
RedHat 7.1 alpha perl-GD-1.33-1.alpha.rpm
ftp://updates.redhat.com/7.1/en/powertools/alpha/perl-GD-1.33-1.alpha. rpm -
RedHat 7.1 i386 perl-Chart-0.99c.pre3-1.i386.rpm
ftp://updates.redhat.com/7.1/en/powertools/i386/ -
RedHat 7.1 i386 perl-DBD-MySQL-1.2215-1.i386.rpm
ftp://updates.redhat.com/7.1/en/powertools/i386/perl-DBD-MySQL-1.2215- 1.i386.rpm -
RedHat 7.1 i386 perl-GD-1.33-1.i386.rpm
ftp://updates.redhat.com/7.1/en/powertools/i386/perl-GD-1.33-1.i386.rp m -
RedHat 7.1 noarch bugzilla-2.14-1.noarch.rpm
ftp://updates.redhat.com/7.1/en/powertools/noarch/bugzilla-2.14-1.noar ch.rpm
Mozilla Bugzilla 2.12
-
Mozilla Bugzilla 2.14
http://ftp.mozilla.org/pub/webtools/bugzilla-2.14.tar.gz -
RedHat 7.0 alpha perl-Chart-0.99c.pre3-1.alpha.rpm
ftp://updates.redhat.com/7.0/en/powertools/alpha/perl-Chart-0.99c.pre3 -1.alpha.rpm -
RedHat 7.0 alpha perl-DBD-MySQL-1.2215-1.alpha.rpm
ftp://updates.redhat.com/7.0/en/powertools/alpha/ -
RedHat 7.0 alpha perl-GD-1.33-1.alpha.rpm
ftp://updates.redhat.com/7.0/en/powertools/alpha/perl-GD-1.33-1.alpha. rpm -
RedHat 7.0 i386 perl-Chart-0.99c.pre3-1.i386.rpm
ftp://updates.redhat.com/7.0/en/powertools/i386/perl-Chart-0.99c.pre3- 1.i386.rpm -
RedHat 7.0 i386 perl-DBD-MySQL-1.2215-1.i386.rpm
ftp://updates.redhat.com/7.0/en/powertools/i386/perl-DBD-MySQL-1.2215- 1.i386.rpm -
RedHat 7.0 i386 perl-GD-1.33-1.i386.rpm
ftp://updates.redhat.com/7.0/en/powertools/i386/perl-GD-1.33-1.i386.rp m -
RedHat 7.0 noarch bugzilla-2.14-1.noarch.rpm
ftp://updates.redhat.com/7.0/en/powertools/noarch/bugzilla-2.14-1.noar ch.rpm -
RedHat 7.1 alpha perl-DBD-MySQL-1.2215-1.alpha.rpm
ftp://updates.redhat.com/7.1/en/powertools/alpha/ -
RedHat 7.1 alpha perl-GD-1.33-1.alpha.rpm
ftp://updates.redhat.com/7.1/en/powertools/alpha/perl-GD-1.33-1.alpha. rpm -
RedHat 7.1 i386 perl-Chart-0.99c.pre3-1.i386.rpm
ftp://updates.redhat.com/7.1/en/powertools/i386/ -
RedHat 7.1 i386 perl-DBD-MySQL-1.2215-1.i386.rpm
ftp://updates.redhat.com/7.1/en/powertools/i386/perl-DBD-MySQL-1.2215- 1.i386.rpm -
RedHat 7.1 i386 perl-GD-1.33-1.i386.rpm
ftp://updates.redhat.com/7.1/en/powertools/i386/perl-GD-1.33-1.i386.rp m -
RedHat 7.1 noarch bugzilla-2.14-1.noarch.rpm
ftp://updates.redhat.com/7.1/en/powertools/noarch/bugzilla-2.14-1.noar ch.rpm
Mozilla Bugzilla 2.8
-
Mozilla Bugzilla 2.14
http://ftp.mozilla.org/pub/webtools/bugzilla-2.14.tar.gz
References
Bugzilla describecomponents.cgi Arbitrary Bug Viewing Vulnerability
References:
References: