Mozilla Bonsai Path Disclosure Vulnerability
BID:5517
Info
Mozilla Bonsai Path Disclosure Vulnerability
| Bugtraq ID: | 5517 |
| Class: | Input Validation Error |
| CVE: |
CVE-2003-0153 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 20 2002 12:00AM |
| Updated: | Jul 11 2009 03:56PM |
| Credit: | Discovery credited to Stan Bubrouski <[email protected]>. |
| Vulnerable: |
Mozilla Bonsai 1.3 |
| Not Vulnerable: | |
Discussion
Mozilla Bonsai Path Disclosure Vulnerability
A path disclosure vulnerability has been reported in Mozilla Bonsai.
An attacker can exploit this vulnerability by making a malformed request to Bonsai. This causes Bonsai to return an error page to the requesting user. This error page will contain the absolute path information about the requested file.
A path disclosure vulnerability has been reported in Mozilla Bonsai.
An attacker can exploit this vulnerability by making a malformed request to Bonsai. This causes Bonsai to return an error page to the requesting user. This error page will contain the absolute path information about the requested file.
Exploit / POC
Mozilla Bonsai Path Disclosure Vulnerability
The following proof of concepts have been provided by Stan Bubrouski <[email protected]>:
/bonsai/cvsview2.cgi
/bonsai/multidiff.cgi
The following proof of concepts have been provided by Stan Bubrouski <[email protected]>:
/bonsai/cvsview2.cgi
/bonsai/multidiff.cgi
Solution / Fix
Mozilla Bonsai Path Disclosure Vulnerability
Solution:
Fixes available:
Mozilla Bonsai 1.3
Solution:
Fixes available:
Mozilla Bonsai 1.3
-
Debian bonsai_1.3+cvs20020224-1woody1_alpha.deb
http://security.debian.org/pool/updates/main/b/bonsai/bonsai_1.3+cvs20 020224-1woody1_alpha.deb -
Debian bonsai_1.3+cvs20020224-1woody1_arm.deb
http://security.debian.org/pool/updates/main/b/bonsai/bonsai_1.3+cvs20 020224-1woody1_arm.deb -
Debian bonsai_1.3+cvs20020224-1woody1_hppa.deb
http://security.debian.org/pool/updates/main/b/bonsai/bonsai_1.3+cvs20 020224-1woody1_hppa.deb -
Debian bonsai_1.3+cvs20020224-1woody1_i386.deb
http://security.debian.org/pool/updates/main/b/bonsai/bonsai_1.3+cvs20 020224-1woody1_i386.deb -
Debian bonsai_1.3+cvs20020224-1woody1_ia64.deb
http://security.debian.org/pool/updates/main/b/bonsai/bonsai_1.3+cvs20 020224-1woody1_ia64.deb -
Debian bonsai_1.3+cvs20020224-1woody1_m68k.deb
http://security.debian.org/pool/updates/main/b/bonsai/bonsai_1.3+cvs20 020224-1woody1_m68k.deb -
Debian bonsai_1.3+cvs20020224-1woody1_mips.deb
http://security.debian.org/pool/updates/main/b/bonsai/bonsai_1.3+cvs20 020224-1woody1_mips.deb -
Debian bonsai_1.3+cvs20020224-1woody1_mipsel.deb
http://security.debian.org/pool/updates/main/b/bonsai/bonsai_1.3+cvs20 020224-1woody1_mipsel.deb -
Debian bonsai_1.3+cvs20020224-1woody1_powerpc.deb
http://security.debian.org/pool/updates/main/b/bonsai/bonsai_1.3+cvs20 020224-1woody1_powerpc.deb -
Debian bonsai_1.3+cvs20020224-1woody1_s390.deb
http://security.debian.org/pool/updates/main/b/bonsai/bonsai_1.3+cvs20 020224-1woody1_s390.deb -
Debian bonsai_1.3+cvs20020224-1woody1_sparc.deb
http://security.debian.org/pool/updates/main/b/bonsai/bonsai_1.3+cvs20 020224-1woody1_sparc.deb