Bugzilla Multiple Vulnerabilities
BID:45982
Info
Bugzilla Multiple Vulnerabilities
| Bugtraq ID: | 45982 |
| Class: | Unknown |
| CVE: |
CVE-2010-4567 CVE-2010-4568 CVE-2010-4569 CVE-2010-4570 CVE-2010-4572 CVE-2011-0046 CVE-2011-0048 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 25 2011 12:00AM |
| Updated: | Apr 13 2015 09:37PM |
| Credit: | Anonymous ("mozilla11"), Michael Brooks (Sitewatch), David Lawrence, Mark Stosberg, Byron Jones, Guy Pyrzak <br> |
| Vulnerable: |
Mozilla Bugzilla 3.6.1 Mozilla Bugzilla 3.4.7 Mozilla Bugzilla 3.4.6 Mozilla Bugzilla 3.4.5 Mozilla Bugzilla 3.4.4 Mozilla Bugzilla 3.4.3 Mozilla Bugzilla 3.4.2 Mozilla Bugzilla 3.4.1 Mozilla Bugzilla 3.2.7 Mozilla Bugzilla 3.2.6 Mozilla Bugzilla 3.2.5 Mozilla Bugzilla 3.2.4 Mozilla Bugzilla 3.2.3 Mozilla Bugzilla 3.2.2 Mozilla Bugzilla 3.2.1 Mozilla Bugzilla 4.0rc1 Mozilla Bugzilla 3.6rc1 Mozilla Bugzilla 3.6.3 Mozilla Bugzilla 3.6.2 Mozilla Bugzilla 3.6 Mozilla Bugzilla 3.4.9 Mozilla Bugzilla 3.4.8 Mozilla Bugzilla 3.4 rc1 Mozilla Bugzilla 3.4 Mozilla Bugzilla 3.2rc2 Mozilla Bugzilla 3.2rc1 Mozilla Bugzilla 3.2.9 Mozilla Bugzilla 3.2.8 Mozilla Bugzilla 3.2 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 |
| Not Vulnerable: |
Mozilla Bugzilla 3.6.4 Mozilla Bugzilla 3.4.10 Mozilla Bugzilla 3.2.10 Mozilla Bugzilla 4.0rc2 |
Discussion
Bugzilla Multiple Vulnerabilities
Bugzilla is prone to the following vulnerabilities:
1. A security-bypass issue.
2. Multiple cross-site scripting vulnerabilities.
3. Multiple cross-site request-forgery vulnerabilities.
Successfully exploiting these issues may allow an attacker to bypass certain security restrictions, execute arbitrary script code in the browser of an unsuspecting user, steal cookie-based authentication credentials or perform certain administrative actions and perform actions in the vulnerable application in the context of the victim.
The following versions are vulnerable:
3.2.x versions prior to 3.2.10
3.4.x versions prior to 3.4.10
3.6.x versions prior to 3.6.4
4.x versions prior to 4.0rc2
Bugzilla is prone to the following vulnerabilities:
1. A security-bypass issue.
2. Multiple cross-site scripting vulnerabilities.
3. Multiple cross-site request-forgery vulnerabilities.
Successfully exploiting these issues may allow an attacker to bypass certain security restrictions, execute arbitrary script code in the browser of an unsuspecting user, steal cookie-based authentication credentials or perform certain administrative actions and perform actions in the vulnerable application in the context of the victim.
The following versions are vulnerable:
3.2.x versions prior to 3.2.10
3.4.x versions prior to 3.4.10
3.6.x versions prior to 3.6.4
4.x versions prior to 4.0rc2
Exploit / POC
Bugzilla Multiple Vulnerabilities
Attackers can use a browser to exploit these issues.
Attackers can use a browser to exploit these issues.
Solution / Fix
Bugzilla Multiple Vulnerabilities
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.