BugZilla ShowVotes.CGI Restricted Bug Comments Revealing Vulnerability
BID:3268
Info
BugZilla ShowVotes.CGI Restricted Bug Comments Revealing Vulnerability
| Bugtraq ID: | 3268 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 29 2001 12:00AM |
| Updated: | Aug 29 2001 12:00AM |
| Credit: | This vulnerability was announced in a Bugzilla Security Advisory dated August 29, 2001. |
| Vulnerable: |
Mozilla Bugzilla 2.12 Mozilla Bugzilla 2.10 Mozilla Bugzilla 2.8 |
| Not Vulnerable: |
Mozilla Bugzilla 2.14 |
Discussion
BugZilla ShowVotes.CGI Restricted Bug Comments Revealing Vulnerability
Bugzilla is the bug tracking software package by the Mozilla project.
It is possible for a remote user to gain access to sensitive bug information through the show_activity.cgi interface. Upon finding a bug that is displayed as restricted through the show_bug.cgi interface, the user may request the bug id through the showvotes.cgi script, which will render the full comments of the bug.
Bugzilla is the bug tracking software package by the Mozilla project.
It is possible for a remote user to gain access to sensitive bug information through the show_activity.cgi interface. Upon finding a bug that is displayed as restricted through the show_bug.cgi interface, the user may request the bug id through the showvotes.cgi script, which will render the full comments of the bug.
Solution / Fix
BugZilla ShowVotes.CGI Restricted Bug Comments Revealing Vulnerability
Solution:
Update available:
Mozilla Bugzilla 2.10
Mozilla Bugzilla 2.12
Mozilla Bugzilla 2.8
Solution:
Update available:
Mozilla Bugzilla 2.10
-
Mozilla Bugzilla 2.14
http://ftp.mozilla.org/pub/webtools/bugzilla-2.14.tar.gz -
RedHat 7.0 alpha perl-Chart-0.99c.pre3-1.alpha.rpm
ftp://updates.redhat.com/7.0/en/powertools/alpha/perl-Chart-0.99c.pre3 -1.alpha.rpm -
RedHat 7.0 alpha perl-DBD-MySQL-1.2215-1.alpha.rpm
ftp://updates.redhat.com/7.0/en/powertools/alpha/ -
RedHat 7.0 alpha perl-GD-1.33-1.alpha.rpm
ftp://updates.redhat.com/7.0/en/powertools/alpha/perl-GD-1.33-1.alpha. rpm -
RedHat 7.0 i386 perl-Chart-0.99c.pre3-1.i386.rpm
ftp://updates.redhat.com/7.0/en/powertools/i386/perl-Chart-0.99c.pre3- 1.i386.rpm -
RedHat 7.0 i386 perl-DBD-MySQL-1.2215-1.i386.rpm
ftp://updates.redhat.com/7.0/en/powertools/i386/perl-DBD-MySQL-1.2215- 1.i386.rpm -
RedHat 7.0 i386 perl-GD-1.33-1.i386.rpm
ftp://updates.redhat.com/7.0/en/powertools/i386/perl-GD-1.33-1.i386.rp m -
RedHat 7.0 noarch bugzilla-2.14-1.noarch.rpm
ftp://updates.redhat.com/7.0/en/powertools/noarch/bugzilla-2.14-1.noar ch.rpm -
RedHat 7.1 alpha perl-DBD-MySQL-1.2215-1.alpha.rpm
ftp://updates.redhat.com/7.1/en/powertools/alpha/ -
RedHat 7.1 alpha perl-GD-1.33-1.alpha.rpm
ftp://updates.redhat.com/7.1/en/powertools/alpha/perl-GD-1.33-1.alpha. rpm -
RedHat 7.1 i386 perl-Chart-0.99c.pre3-1.i386.rpm
ftp://updates.redhat.com/7.1/en/powertools/i386/ -
RedHat 7.1 i386 perl-DBD-MySQL-1.2215-1.i386.rpm
ftp://updates.redhat.com/7.1/en/powertools/i386/perl-DBD-MySQL-1.2215- 1.i386.rpm -
RedHat 7.1 i386 perl-GD-1.33-1.i386.rpm
ftp://updates.redhat.com/7.1/en/powertools/i386/perl-GD-1.33-1.i386.rp m -
RedHat 7.1 noarch bugzilla-2.14-1.noarch.rpm
ftp://updates.redhat.com/7.1/en/powertools/noarch/bugzilla-2.14-1.noar ch.rpm
Mozilla Bugzilla 2.12
-
Mozilla Bugzilla 2.14
http://ftp.mozilla.org/pub/webtools/bugzilla-2.14.tar.gz -
RedHat 7.0 alpha perl-Chart-0.99c.pre3-1.alpha.rpm
ftp://updates.redhat.com/7.0/en/powertools/alpha/perl-Chart-0.99c.pre3 -1.alpha.rpm -
RedHat 7.0 alpha perl-DBD-MySQL-1.2215-1.alpha.rpm
ftp://updates.redhat.com/7.0/en/powertools/alpha/ -
RedHat 7.0 alpha perl-GD-1.33-1.alpha.rpm
ftp://updates.redhat.com/7.0/en/powertools/alpha/perl-GD-1.33-1.alpha. rpm -
RedHat 7.0 i386 perl-Chart-0.99c.pre3-1.i386.rpm
ftp://updates.redhat.com/7.0/en/powertools/i386/perl-Chart-0.99c.pre3- 1.i386.rpm -
RedHat 7.0 i386 perl-DBD-MySQL-1.2215-1.i386.rpm
ftp://updates.redhat.com/7.0/en/powertools/i386/perl-DBD-MySQL-1.2215- 1.i386.rpm -
RedHat 7.0 i386 perl-GD-1.33-1.i386.rpm
ftp://updates.redhat.com/7.0/en/powertools/i386/perl-GD-1.33-1.i386.rp m -
RedHat 7.0 noarch bugzilla-2.14-1.noarch.rpm
ftp://updates.redhat.com/7.0/en/powertools/noarch/bugzilla-2.14-1.noar ch.rpm -
RedHat 7.1 alpha perl-DBD-MySQL-1.2215-1.alpha.rpm
ftp://updates.redhat.com/7.1/en/powertools/alpha/ -
RedHat 7.1 alpha perl-GD-1.33-1.alpha.rpm
ftp://updates.redhat.com/7.1/en/powertools/alpha/perl-GD-1.33-1.alpha. rpm -
RedHat 7.1 i386 perl-Chart-0.99c.pre3-1.i386.rpm
ftp://updates.redhat.com/7.1/en/powertools/i386/ -
RedHat 7.1 i386 perl-DBD-MySQL-1.2215-1.i386.rpm
ftp://updates.redhat.com/7.1/en/powertools/i386/perl-DBD-MySQL-1.2215- 1.i386.rpm -
RedHat 7.1 i386 perl-GD-1.33-1.i386.rpm
ftp://updates.redhat.com/7.1/en/powertools/i386/perl-GD-1.33-1.i386.rp m -
RedHat 7.1 noarch bugzilla-2.14-1.noarch.rpm
ftp://updates.redhat.com/7.1/en/powertools/noarch/bugzilla-2.14-1.noar ch.rpm
Mozilla Bugzilla 2.8
-
Mozilla Bugzilla 2.14
http://ftp.mozilla.org/pub/webtools/bugzilla-2.14.tar.gz