BugZilla Show_Bug.CGI Product Pulldown Bug Disclosure Vulnerability
BID:3798
Info
BugZilla Show_Bug.CGI Product Pulldown Bug Disclosure Vulnerability
| Bugtraq ID: | 3798 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 28 2001 12:00AM |
| Updated: | Sep 28 2001 12:00AM |
| Credit: | This issue was originally reported to the Bugzilla Development Homepage as Bugzilla Bug 102141. |
| Vulnerable: |
Mozilla Bugzilla 2.14 Mozilla Bugzilla 2.12 Mozilla Bugzilla 2.10 Mozilla Bugzilla 2.8 Mozilla Bugzilla 2.6 Mozilla Bugzilla 2.4 |
| Not Vulnerable: |
Mozilla Bugzilla 2.14.1 |
Discussion
BugZilla Show_Bug.CGI Product Pulldown Bug Disclosure Vulnerability
Bugzilla is the bug tracking software package by the Mozilla project. It can be configured to run on Microsoft Windows and various Unix/Linux platforms.
It is possible to get a listing of all existing bugs by using the Product Pulldown menu in the show_bug.cgi script. Normally, a user should only be able to get a listing of products/bugs they are able to access.
Bugzilla is the bug tracking software package by the Mozilla project. It can be configured to run on Microsoft Windows and various Unix/Linux platforms.
It is possible to get a listing of all existing bugs by using the Product Pulldown menu in the show_bug.cgi script. Normally, a user should only be able to get a listing of products/bugs they are able to access.
Exploit / POC
BugZilla Show_Bug.CGI Product Pulldown Bug Disclosure Vulnerability
There is no exploit code required.
There is no exploit code required.
Solution / Fix
BugZilla Show_Bug.CGI Product Pulldown Bug Disclosure Vulnerability
Solution:
This issue has been addressed by the vendor is versions 2.14.1 and later. Users are advised to upgrade to the most recent version.
It should also be noted that users who are running version 2.15 checked out of
cvs prior to 15 December 2001 are strongly recommended to use 'cvs update' to obtain the current cvs code.
Mozilla Bugzilla 2.10
Mozilla Bugzilla 2.12
Mozilla Bugzilla 2.14
Mozilla Bugzilla 2.4
Mozilla Bugzilla 2.6
Mozilla Bugzilla 2.8
Solution:
This issue has been addressed by the vendor is versions 2.14.1 and later. Users are advised to upgrade to the most recent version.
It should also be noted that users who are running version 2.15 checked out of
cvs prior to 15 December 2001 are strongly recommended to use 'cvs update' to obtain the current cvs code.
Mozilla Bugzilla 2.10
-
Mozilla bugzilla-LATEST.tar.gz
http://ftp.mozilla.org/pub/webtools/bugzilla-LATEST.tar.gz
Mozilla Bugzilla 2.12
-
Mozilla bugzilla-LATEST.tar.gz
http://ftp.mozilla.org/pub/webtools/bugzilla-LATEST.tar.gz
Mozilla Bugzilla 2.14
-
Mozilla bugzilla-LATEST.tar.gz
http://ftp.mozilla.org/pub/webtools/bugzilla-LATEST.tar.gz
Mozilla Bugzilla 2.4
-
Mozilla bugzilla-LATEST.tar.gz
http://ftp.mozilla.org/pub/webtools/bugzilla-LATEST.tar.gz
Mozilla Bugzilla 2.6
-
Mozilla bugzilla-LATEST.tar.gz
http://ftp.mozilla.org/pub/webtools/bugzilla-LATEST.tar.gz
Mozilla Bugzilla 2.8
-
Mozilla bugzilla-LATEST.tar.gz
http://ftp.mozilla.org/pub/webtools/bugzilla-LATEST.tar.gz
References
BugZilla Show_Bug.CGI Product Pulldown Bug Disclosure Vulnerability
References:
References:
- Bugzilla Bug 102141 [security] When changing a bug... (Mozilla)
- Bugzilla Homepage (Mozilla)