Bugzilla Group Selection During Bug Creation Information Disclosure Vulnerability

Bugtraq ID:	41397
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 05 2010 12:00AM
Updated:	Jul 05 2010 12:00AM
Credit:	Max Kanat-Alexander, Frederic Buclin
Vulnerable:	Mozilla Bugzilla 3.7.1 Mozilla Bugzilla 3.7
Not Vulnerable:	Mozilla Bugzilla 3.7.2

Bugzilla Group Selection During Bug Creation Information Disclosure Vulnerability

Bugzilla is prone to an information-disclosure vulnerability.

Attackers can exploit this issue to obtain potentially sensitive information that may aid in other attacks.

Bugzilla 3.7 and 3.7.1 are vulnerable.

Bugzilla Group Selection During Bug Creation Information Disclosure Vulnerability

An attacker can exploit this issue via a browser.

Bugzilla Group Selection During Bug Creation Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references for more information.


Mozilla Bugzilla 3.7

• Mozilla bugzilla-3.7.2.tar.gz
  http://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-3.7.2.tar.gz

Mozilla Bugzilla 3.7.1

• Mozilla bugzilla-3.7.2.tar.gz
  http://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-3.7.2.tar.gz

Bugzilla Group Selection During Bug Creation Information Disclosure Vulnerability

References:

• Bug 574892 - Initial CC and Default QA Contact not set on bugs if the arguments (Max Kanat-Alexander)
  
• Bugzilla Homepage (Mozilla)
  
• 3.7.1 Security Advisory (Mozilla)