Mozilla Bugzilla URL Password Information Disclosure Vulnerability

Bugtraq ID:	36372
Class:	Design Error
CVE:	CVE-2009-3166
Remote:	Yes
Local:	No
Published:	Sep 11 2009 12:00AM
Updated:	Jun 04 2010 08:40PM
Credit:	Max Kanat-Alexander
Vulnerable:	Mozilla Bugzilla 3.4.1 Mozilla Bugzilla 3.4 rc1 Mozilla Bugzilla 3.4 Gentoo Linux
Not Vulnerable:	Mozilla Bugzilla 3.4.2

Mozilla Bugzilla URL Password Information Disclosure Vulnerability

Bugzilla is prone to an information-disclosure vulnerability.

Successful exploits will allow attackers to obtain potentially sensitive information that may aid in further attacks.

This issue affects Bugzilla 3.4rc1 through 3.4.1.

Mozilla Bugzilla URL Password Information Disclosure Vulnerability

Attackers can use social engineering combined with readily available tools to exploit this issue.

Mozilla Bugzilla URL Password Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references for more information.


Mozilla Bugzilla 3.4 rc1

• Mozilla bugzilla-3.4.2.tar.gz
  http://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-3.4.2.tar.gz

Mozilla Bugzilla 3.4

• Mozilla bugzilla-3.4.2.tar.gz
  http://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-3.4.2.tar.gz

Mozilla Bugzilla 3.4.1

• Mozilla bugzilla-3.4.2.tar.gz
  http://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-3.4.2.tar.gz

Mozilla Bugzilla URL Password Information Disclosure Vulnerability

References:

• (CVE-2009-3166) [SECURITY] Logging in after changing your password exposes your (Mozilla)
  
• 3.4.1, 3.2.4, and 3.0.8 Security Advisory (Mozilla)
  
• Bugzilla Homepage (Mozilla)