Bugzilla Directory Access Information Disclosure Vulnerability
BID:38025
Info
Bugzilla Directory Access Information Disclosure Vulnerability
| Bugtraq ID: | 38025 |
| Class: | Access Validation Error |
| CVE: |
CVE-2009-3989 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 01 2010 12:00AM |
| Updated: | Apr 16 2015 05:43PM |
| Credit: | Max Kanat-Alexander, Frédéric Buclin, Reed Loden, Joel Peshkin |
| Vulnerable: |
Mozilla Bugzilla 3.5.2 Mozilla Bugzilla 3.5.1 Mozilla Bugzilla 3.4.4 Mozilla Bugzilla 3.4.3 Mozilla Bugzilla 3.4.2 Mozilla Bugzilla 3.4.1 Mozilla Bugzilla 3.3.4 Mozilla Bugzilla 3.3.3 Mozilla Bugzilla 3.3.2 Mozilla Bugzilla 3.3.1 Mozilla Bugzilla 3.2.5 Mozilla Bugzilla 3.2.4 Mozilla Bugzilla 3.2.3 Mozilla Bugzilla 3.2.2 Mozilla Bugzilla 3.2.1 Mozilla Bugzilla 3.1.4 Mozilla Bugzilla 3.1.3 Mozilla Bugzilla 3.1.2 Mozilla Bugzilla 3.1.1 Mozilla Bugzilla 3.1 Mozilla Bugzilla 3.0.10 Mozilla Bugzilla 3.0.9 Mozilla Bugzilla 3.0.8 Mozilla Bugzilla 3.0.7 Mozilla Bugzilla 3.0.6 Mozilla Bugzilla 3.0.5 Mozilla Bugzilla 3.0.4 Mozilla Bugzilla 3.0.2 Mozilla Bugzilla 3.0.1 Mozilla Bugzilla 3.0 Mozilla Bugzilla 2.23.4 Mozilla Bugzilla 2.23.3 Mozilla Bugzilla 2.23.2 Mozilla Bugzilla 2.22.7 Mozilla Bugzilla 2.22.6 Mozilla Bugzilla 2.22.5 Mozilla Bugzilla 2.22.4 Mozilla Bugzilla 2.22.3 Mozilla Bugzilla 2.22.2 Mozilla Bugzilla 2.22.1 Mozilla Bugzilla 2.21.2 Mozilla Bugzilla 2.21.1 Mozilla Bugzilla 2.21 Mozilla Bugzilla 2.20.7 Mozilla Bugzilla 2.20.6 Mozilla Bugzilla 2.20.5 Mozilla Bugzilla 2.20.4 Mozilla Bugzilla 2.20.3 Mozilla Bugzilla 2.20.2 Mozilla Bugzilla 2.20.1 Mozilla Bugzilla 2.20 rc2 Mozilla Bugzilla 2.20 rc1 Mozilla Bugzilla 2.19.3 Mozilla Bugzilla 2.19.2 Mozilla Bugzilla 2.19.1 Mozilla Bugzilla 2.19 Mozilla Bugzilla 2.18.6 Mozilla Bugzilla 2.18.5 Mozilla Bugzilla 2.18.4 Mozilla Bugzilla 2.18.3 Mozilla Bugzilla 2.18.2 Mozilla Bugzilla 2.18.1 Mozilla Bugzilla 2.18 rc3 Mozilla Bugzilla 2.18 rc2 Mozilla Bugzilla 2.18 rc1 Mozilla Bugzilla 2.17.7 Mozilla Bugzilla 2.17.6 Mozilla Bugzilla 2.17.5 Mozilla Bugzilla 2.17.4 Mozilla Bugzilla 2.17.3 Mozilla Bugzilla 2.17.2 Mozilla Bugzilla 2.17.1 Mozilla Bugzilla 2.17 Mozilla Bugzilla 2.16.11 Mozilla Bugzilla 2.16.10 Mozilla Bugzilla 2.16.9 Mozilla Bugzilla 2.16.8 Mozilla Bugzilla 2.16.7 Mozilla Bugzilla 2.16.6 Mozilla Bugzilla 2.16.5 Mozilla Bugzilla 2.16.4 Mozilla Bugzilla 2.16.3 Mozilla Bugzilla 2.16.2 Mozilla Bugzilla 2.16.1 Mozilla Bugzilla 2.16 .10 Mozilla Bugzilla 2.16 Mozilla Bugzilla 2.14.5 Mozilla Bugzilla 2.14.4 Mozilla Bugzilla 2.14.3 Mozilla Bugzilla 2.14.2 Mozilla Bugzilla 2.14.1 Mozilla Bugzilla 2.14 Mozilla Bugzilla 2.12 Mozilla Bugzilla 2.10 Mozilla Bugzilla 2.9 Mozilla Bugzilla 2.8 Mozilla Bugzilla 2.6 Mozilla Bugzilla 2.4 Mozilla Bugzilla 3.5 Mozilla Bugzilla 3.4 rc1 Mozilla Bugzilla 3.4 Mozilla Bugzilla 3.2rc2 Mozilla Bugzilla 3.2rc1 Mozilla Bugzilla 3.2 Mozilla Bugzilla 2.22 RC1 Mozilla Bugzilla 2.22 Mozilla Bugzilla 2.20 Gentoo Linux |
| Not Vulnerable: |
Mozilla Bugzilla 3.5.3 Mozilla Bugzilla 3.4.5 Mozilla Bugzilla 3.2.6 Mozilla Bugzilla 3.0.11 |
Discussion
Bugzilla Directory Access Information Disclosure Vulnerability
Bugzilla is prone to an information-disclosure vulnerability.
Exploits may allow attackers to obtain potentially sensitive information that may aid in other attacks.
Versions prior to Bugzilla 3.0.11, 3.2.6, 3.4.5, and 3.5.3 are affected.
Bugzilla is prone to an information-disclosure vulnerability.
Exploits may allow attackers to obtain potentially sensitive information that may aid in other attacks.
Versions prior to Bugzilla 3.0.11, 3.2.6, 3.4.5, and 3.5.3 are affected.
Exploit / POC
Bugzilla Directory Access Information Disclosure Vulnerability
An attacker can exploit this issue via a browser.
An attacker can exploit this issue via a browser.
Solution / Fix
Bugzilla Directory Access Information Disclosure Vulnerability
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
Bugzilla Directory Access Information Disclosure Vulnerability
References:
References:
- Bugzilla Homepage (Mozilla)
- 3.0.10, 3.2.5, 3.4.4, and 3.5.2 Security Advisory (Mozilla)