Bugzilla 'data/webdot/' and '.bzr/' Information Disclosure Vulnerability

Bugtraq ID:	41312
Class:	Configuration Error
CVE:	CVE-2010-2470
Remote:	Yes
Local:	No
Published:	Jun 30 2010 12:00AM
Updated:	Jun 30 2010 12:00AM
Credit:	Reported by the Vendor
Vulnerable:	Mozilla Bugzilla 3.7.1 Mozilla Bugzilla 3.6.1 Mozilla Bugzilla 3.5.3 Mozilla Bugzilla 3.5.2 Mozilla Bugzilla 3.5.1 Mozilla Bugzilla 3.7 Mozilla Bugzilla 3.6
Not Vulnerable:

Bugzilla 'data/webdot/' and '.bzr/' Information Disclosure Vulnerability

Bugzilla is prone to an information-disclosure vulnerability.

Successful exploits may allow attackers to obtain potentially sensitive information that may aid in other attacks.

This issue affects the following:

Bugzilla 3.5.1 through 3.6.1
Bugzilla 3.7 through 3.7.1

NOTE: This vulnerability is related to the issue described in BID 41144 (Bugzilla 'localconfig' Information Disclosure Vulnerability)

Bugzilla 'data/webdot/' and '.bzr/' Information Disclosure Vulnerability

An attacker can exploit this issue via a browser.

Bugzilla 'data/webdot/' and '.bzr/' Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Bugzilla 'data/webdot/' and '.bzr/' Information Disclosure Vulnerability

References:

• Bugzilla Homepage (Mozilla)
  
• checksetup.pl with $use_suexec=1 sets .bzr/ and data/webdot/ as world readable (Mozilla)