Bugzilla 'show_bug.cgi' Information Disclosure Vulnerability

Bugtraq ID:	35916
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 01 2009 12:00AM
Updated:	Aug 27 2009 09:22PM
Credit:	Frédéric Buclin, Max Kanat-Alexander, and Sergej Pupykin
Vulnerable:	Mozilla Bugzilla 3.3.4 Mozilla Bugzilla 3.4 rc1 Mozilla Bugzilla 3.4
Not Vulnerable:	Mozilla Bugzilla 3.4.1

Bugzilla 'show_bug.cgi' Information Disclosure Vulnerability

Bugzilla is prone to an information-disclosure vulnerability.

Successful exploits will allow authenticated attackers to obtain potentially sensitive information that may aid in further attacks.

The following are vulnerable:

Bugzilla 3.3.4, 3.4rc1, and 3.4.

Bugzilla 'show_bug.cgi' Information Disclosure Vulnerability

An attacker can exploit this issue via a browser.

Bugzilla 'show_bug.cgi' Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references for details.


Mozilla Bugzilla 3.4 rc1

• Mozilla bugzilla-3.4.1.tar.gz
  http://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-3.4.1.tar.gz

Mozilla Bugzilla 3.4

• Mozilla bugzilla-3.4.1.tar.gz
  http://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-3.4.1.tar.gz

Mozilla Bugzilla 3.3.4

• Mozilla bugzilla-3.4.1.tar.gz
  http://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-3.4.1.tar.gz

Bugzilla 'show_bug.cgi' Information Disclosure Vulnerability

References:

• Bugzilla Homepage (Mozilla)
  
• 3.4 Security Advisory (Mozilla)