Bugzilla process_bug.cgi Information Disclosure Vulnerability
BID:3272
Info
Bugzilla process_bug.cgi Information Disclosure Vulnerability
| Bugtraq ID: | 3272 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 29 2001 12:00AM |
| Updated: | Aug 29 2001 12:00AM |
| Credit: | This vulnerability was submitted to BugTraq on August 29th, 2001 by David Miller <[email protected]>. |
| Vulnerable: |
Mozilla Bugzilla 2.12 Mozilla Bugzilla 2.10 Mozilla Bugzilla 2.8 Mozilla Bugzilla 2.6 Mozilla Bugzilla 2.4 |
| Not Vulnerable: |
Mozilla Bugzilla 2.14 |
Discussion
Bugzilla process_bug.cgi Information Disclosure Vulnerability
Bugzilla is a free, open source bug tracking and reporting appplication. It allows users to submit bugs, offers a forum for discussing bugs, keeps track of the status of bugs, and can restrict who has access to bug information.
A vulnerability in 'process_bug.cgi' for Bugzilla(v2.12 and earlier) allows users to access restricted bug information. Bugzilla uses group bits to determine which users may access information about bugs. When using 'process_bug.cgi' to mass-edit bugs the new product name for the the bug is not set with the group bit, which allows the user to bypass the access controls enforced by aspects of Bugzilla.
Bugzilla is a free, open source bug tracking and reporting appplication. It allows users to submit bugs, offers a forum for discussing bugs, keeps track of the status of bugs, and can restrict who has access to bug information.
A vulnerability in 'process_bug.cgi' for Bugzilla(v2.12 and earlier) allows users to access restricted bug information. Bugzilla uses group bits to determine which users may access information about bugs. When using 'process_bug.cgi' to mass-edit bugs the new product name for the the bug is not set with the group bit, which allows the user to bypass the access controls enforced by aspects of Bugzilla.
Solution / Fix
Bugzilla process_bug.cgi Information Disclosure Vulnerability
Solution:
Updates available:
Mozilla Bugzilla 2.10
Mozilla Bugzilla 2.12
Mozilla Bugzilla 2.8
Solution:
Updates available:
Mozilla Bugzilla 2.10
-
Mozilla Bugzilla 2.14
http://ftp.mozilla.org/pub/webtools/bugzilla-2.14.tar.gz -
RedHat 7.0 alpha perl-Chart-0.99c.pre3-1.alpha.rpm
ftp://updates.redhat.com/7.0/en/powertools/alpha/perl-Chart-0.99c.pre3 -1.alpha.rpm -
RedHat 7.0 alpha perl-DBD-MySQL-1.2215-1.alpha.rpm
ftp://updates.redhat.com/7.0/en/powertools/alpha/ -
RedHat 7.0 alpha perl-GD-1.33-1.alpha.rpm
ftp://updates.redhat.com/7.0/en/powertools/alpha/perl-GD-1.33-1.alpha. rpm -
RedHat 7.0 i386 perl-Chart-0.99c.pre3-1.i386.rpm
ftp://updates.redhat.com/7.0/en/powertools/i386/perl-Chart-0.99c.pre3- 1.i386.rpm -
RedHat 7.0 i386 perl-DBD-MySQL-1.2215-1.i386.rpm
ftp://updates.redhat.com/7.0/en/powertools/i386/perl-DBD-MySQL-1.2215- 1.i386.rpm -
RedHat 7.0 i386 perl-GD-1.33-1.i386.rpm
ftp://updates.redhat.com/7.0/en/powertools/i386/perl-GD-1.33-1.i386.rp m -
RedHat 7.0 noarch bugzilla-2.14-1.noarch.rpm
ftp://updates.redhat.com/7.0/en/powertools/noarch/bugzilla-2.14-1.noar ch.rpm -
RedHat 7.1 alpha perl-DBD-MySQL-1.2215-1.alpha.rpm
ftp://updates.redhat.com/7.1/en/powertools/alpha/ -
RedHat 7.1 alpha perl-GD-1.33-1.alpha.rpm
ftp://updates.redhat.com/7.1/en/powertools/alpha/perl-GD-1.33-1.alpha. rpm -
RedHat 7.1 i386 perl-Chart-0.99c.pre3-1.i386.rpm
ftp://updates.redhat.com/7.1/en/powertools/i386/ -
RedHat 7.1 i386 perl-DBD-MySQL-1.2215-1.i386.rpm
ftp://updates.redhat.com/7.1/en/powertools/i386/perl-DBD-MySQL-1.2215- 1.i386.rpm -
RedHat 7.1 i386 perl-GD-1.33-1.i386.rpm
ftp://updates.redhat.com/7.1/en/powertools/i386/perl-GD-1.33-1.i386.rp m -
RedHat 7.1 noarch bugzilla-2.14-1.noarch.rpm
ftp://updates.redhat.com/7.1/en/powertools/noarch/bugzilla-2.14-1.noar ch.rpm
Mozilla Bugzilla 2.12
-
Mozilla Bugzilla 2.14
http://ftp.mozilla.org/pub/webtools/bugzilla-2.14.tar.gz -
RedHat 7.0 alpha perl-Chart-0.99c.pre3-1.alpha.rpm
ftp://updates.redhat.com/7.0/en/powertools/alpha/perl-Chart-0.99c.pre3 -1.alpha.rpm -
RedHat 7.0 alpha perl-DBD-MySQL-1.2215-1.alpha.rpm
ftp://updates.redhat.com/7.0/en/powertools/alpha/ -
RedHat 7.0 alpha perl-GD-1.33-1.alpha.rpm
ftp://updates.redhat.com/7.0/en/powertools/alpha/perl-GD-1.33-1.alpha. rpm -
RedHat 7.0 i386 perl-Chart-0.99c.pre3-1.i386.rpm
ftp://updates.redhat.com/7.0/en/powertools/i386/perl-Chart-0.99c.pre3- 1.i386.rpm -
RedHat 7.0 i386 perl-DBD-MySQL-1.2215-1.i386.rpm
ftp://updates.redhat.com/7.0/en/powertools/i386/perl-DBD-MySQL-1.2215- 1.i386.rpm -
RedHat 7.0 i386 perl-GD-1.33-1.i386.rpm
ftp://updates.redhat.com/7.0/en/powertools/i386/perl-GD-1.33-1.i386.rp m -
RedHat 7.0 noarch bugzilla-2.14-1.noarch.rpm
ftp://updates.redhat.com/7.0/en/powertools/noarch/bugzilla-2.14-1.noar ch.rpm -
RedHat 7.1 alpha perl-DBD-MySQL-1.2215-1.alpha.rpm
ftp://updates.redhat.com/7.1/en/powertools/alpha/ -
RedHat 7.1 alpha perl-GD-1.33-1.alpha.rpm
ftp://updates.redhat.com/7.1/en/powertools/alpha/perl-GD-1.33-1.alpha. rpm -
RedHat 7.1 i386 perl-Chart-0.99c.pre3-1.i386.rpm
ftp://updates.redhat.com/7.1/en/powertools/i386/ -
RedHat 7.1 i386 perl-DBD-MySQL-1.2215-1.i386.rpm
ftp://updates.redhat.com/7.1/en/powertools/i386/perl-DBD-MySQL-1.2215- 1.i386.rpm -
RedHat 7.1 i386 perl-GD-1.33-1.i386.rpm
ftp://updates.redhat.com/7.1/en/powertools/i386/perl-GD-1.33-1.i386.rp m -
RedHat 7.1 noarch bugzilla-2.14-1.noarch.rpm
ftp://updates.redhat.com/7.1/en/powertools/noarch/bugzilla-2.14-1.noar ch.rpm
Mozilla Bugzilla 2.8
-
Mozilla Bugzilla 2.14
http://ftp.mozilla.org/pub/webtools/bugzilla-2.14.tar.gz