Bugzilla Multiple Vulnerabilities

Bugtraq ID:	8953
Class:	Unknown
CVE:	CVE-2003-1042 CVE-2003-1043 CVE-2003-1044 CVE-2003-1045 CVE-2003-1046
Remote:	Yes
Local:	Yes
Published:	Nov 03 2003 12:00AM
Updated:	Jul 12 2009 12:56AM
Credit:	The disclosure of these issues has been credited to Bradley Baetz, Ryan Cleary, Andrew Eross, Vlad Dascalu, and Stefan Mayr.
Vulnerable:	Mozilla Bugzilla 2.17.4 Mozilla Bugzilla 2.17.3 Mozilla Bugzilla 2.17.1 Mozilla Bugzilla 2.16.3 Mozilla Bugzilla 2.16.2 Mozilla Bugzilla 2.16.1 Mozilla Bugzilla 2.16 - Mandriva Linux Mandrake 9.0 - Mandriva Linux Mandrake 9.0 Mozilla Bugzilla 2.14.5 Mozilla Bugzilla 2.14.4 Mozilla Bugzilla 2.14.3 Mozilla Bugzilla 2.14.2 + Debian Linux 3.0 sparc + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 s/390 + Debian Linux 3.0 s/390 + Debian Linux 3.0 s/390 + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 ppc + Debian Linux 3.0 ppc + Debian Linux 3.0 ppc + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mipsel + Debian Linux 3.0 mipsel + Debian Linux 3.0 mipsel + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 mips + Debian Linux 3.0 mips + Debian Linux 3.0 mips + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 m68k + Debian Linux 3.0 m68k + Debian Linux 3.0 m68k + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 hppa + Debian Linux 3.0 hppa + Debian Linux 3.0 hppa + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 arm + Debian Linux 3.0 arm + Debian Linux 3.0 arm + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 alpha + Debian Linux 3.0 alpha + Debian Linux 3.0 alpha + Debian Linux 3.0 alpha + Debian Linux 3.0 + Debian Linux 3.0 + Debian Linux 3.0 + Debian Linux 3.0 + Debian Linux 3.0 Mozilla Bugzilla 2.14.1 Mozilla Bugzilla 2.14 - Redhat Linux 7.1 - Redhat Linux 7.1 - Redhat Linux 7.0 - Redhat Linux 7.0 - Redhat Linux 7.0 - Redhat Linux 7.0 - Redhat Linux 7.0 Mozilla Bugzilla 2.12 Mozilla Bugzilla 2.10 Mozilla Bugzilla 2.8 - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows NT 3.5.1 - Microsoft Windows NT 3.5.1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 Mozilla Bugzilla 2.6 Mozilla Bugzilla 2.4
Not Vulnerable:	Mozilla Bugzilla 2.17.5 Mozilla Bugzilla 2.16.4

Bugzilla Multiple Vulnerabilities

Multiple vulnerabilities has been reported to exist in the software. The issues include SQL injection, unauthorized privileges, and information disclosure.

Bugzilla Multiple Vulnerabilities

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Bugzilla Multiple Vulnerabilities

Solution:
The vendor has released versions 2.16.4 and 2.17.5 of Bugzilla to address these issues.

Conectiva has released an advisory CLA-2003:774 to address this issue. Please see the referenced advisory for detailed information about obtaining fixes.


Mozilla Bugzilla 2.10

• Mozilla bugzilla-2.16.4.tar.gz
  ftp://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-2.16.4.tar.gz

Mozilla Bugzilla 2.12

• Mozilla bugzilla-2.16.4.tar.gz
  ftp://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-2.16.4.tar.gz

Mozilla Bugzilla 2.14

• Mozilla bugzilla-2.16.4.tar.gz
  ftp://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-2.16.4.tar.gz

Mozilla Bugzilla 2.14.1

• Mozilla bugzilla-2.16.4.tar.gz
  ftp://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-2.16.4.tar.gz

Mozilla Bugzilla 2.14.2

• Mozilla bugzilla-2.16.4.tar.gz
  ftp://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-2.16.4.tar.gz

Mozilla Bugzilla 2.14.3

• Mozilla bugzilla-2.16.4.tar.gz
  ftp://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-2.16.4.tar.gz

Mozilla Bugzilla 2.14.4

• Mozilla bugzilla-2.16.4.tar.gz
  ftp://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-2.16.4.tar.gz

Mozilla Bugzilla 2.14.5

• Mozilla bugzilla-2.16.4.tar.gz
  ftp://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-2.16.4.tar.gz

Mozilla Bugzilla 2.16

• Mozilla bugzilla-2.16.4.tar.gz
  ftp://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-2.16.4.tar.gz

Mozilla Bugzilla 2.16.1

• Mozilla bugzilla-2.16.4.tar.gz
  ftp://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-2.16.4.tar.gz

Mozilla Bugzilla 2.16.2

• Mozilla bugzilla-2.16.4.tar.gz
  ftp://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-2.16.4.tar.gz

Mozilla Bugzilla 2.16.3

• Conectiva bugzilla-2.16.4-29154U90_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/9/RPMS/bugzilla-2.16.4-29154U90_1c l.i386.rpm


• Conectiva bugzilla-doc-2.16.4-29154U90_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/9/RPMS/bugzilla-doc-2.16.4-29154U9 0_1cl.i386.rpm


• Mozilla bugzilla-2.16.4.tar.gz
  ftp://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-2.16.4.tar.gz

Mozilla Bugzilla 2.17.1

• Mozilla bugzilla-2.17.5.tar.gz
  ftp://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-2.17.5.tar.gz

Mozilla Bugzilla 2.17.3

• Mozilla bugzilla-2.17.5.tar.gz
  ftp://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-2.17.5.tar.gz

Mozilla Bugzilla 2.17.4

• Mozilla bugzilla-2.17.5.tar.gz
  ftp://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-2.17.5.tar.gz

Mozilla Bugzilla 2.4

• Mozilla bugzilla-2.16.4.tar.gz
  ftp://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-2.16.4.tar.gz

Mozilla Bugzilla 2.6

• Mozilla bugzilla-2.16.4.tar.gz
  ftp://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-2.16.4.tar.gz

Mozilla Bugzilla 2.8

• Mozilla bugzilla-2.16.4.tar.gz
  ftp://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-2.16.4.tar.gz

Bugzilla Multiple Vulnerabilities

References:

• Bugzilla Homepage (Mozilla)
  
• [BUGZILLA] Security Advisory - SQL injection, information leak (David Miller )