Bugzilla Response Splitting and Security Bypass Vulnerabilities
BID:44618
Info
Bugzilla Response Splitting and Security Bypass Vulnerabilities
| Bugtraq ID: | 44618 |
| Class: | Unknown |
| CVE: |
CVE-2010-3172 CVE-2010-3764 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 03 2010 12:00AM |
| Updated: | Apr 13 2015 09:20PM |
| Credit: | Philip Gillissen, Mozilla |
| Vulnerable: |
Mozilla Bugzilla 3.6.1 Mozilla Bugzilla 3.4.7 Mozilla Bugzilla 3.4.6 Mozilla Bugzilla 3.4.5 Mozilla Bugzilla 3.4.4 Mozilla Bugzilla 3.4.3 Mozilla Bugzilla 3.4.2 Mozilla Bugzilla 3.4.1 Mozilla Bugzilla 3.2.7 Mozilla Bugzilla 3.2.6 Mozilla Bugzilla 3.2.5 Mozilla Bugzilla 3.2.4 Mozilla Bugzilla 3.2.3 Mozilla Bugzilla 3.2.2 Mozilla Bugzilla 3.2.1 Mozilla Bugzilla 3.6.2 Mozilla Bugzilla 3.6 Mozilla Bugzilla 3.4.8 Mozilla Bugzilla 3.4 rc1 Mozilla Bugzilla 3.4 Mozilla Bugzilla 3.2.8 Mozilla Bugzilla 3.2 Gentoo Linux |
| Not Vulnerable: |
Mozilla Bugzilla 3.6.3 Mozilla Bugzilla 3.4.9 Mozilla Bugzilla 3.2.9 |
Discussion
Bugzilla Response Splitting and Security Bypass Vulnerabilities
Bugzilla is prone to a response-splitting vulnerability and a security-bypass vulnerability.
Successfully exploiting these issues may allow an attacker to bypass certain security restrictions; obtain sensitive information; and influence or misrepresent how web content is served, cached, or interpreted. This could aid in various attacks that try to instill client users with a false sense of trust.
These issues affect versions prior to 3.2.9, 3.4.9, and 3.6.3.
Bugzilla is prone to a response-splitting vulnerability and a security-bypass vulnerability.
Successfully exploiting these issues may allow an attacker to bypass certain security restrictions; obtain sensitive information; and influence or misrepresent how web content is served, cached, or interpreted. This could aid in various attacks that try to instill client users with a false sense of trust.
These issues affect versions prior to 3.2.9, 3.4.9, and 3.6.3.