 Two weaknesses have been reported in Bugzilla, which can be exploited by malicious users to gain knowledge of sensitive information.
1) Users can determine whether or not a given invisible product exists, as an access denied error is returned when the user attempts to access a valid product.
Users can also enter bugs into products closed for bug entry, if a valid product name is known.
This weakness affects versions 2.10 through 2.18, 2.19.1, and 2.19.2.
2) A user's password may be embedded as part of a report URL, which causes it to be visible in the web logs.
This weakness affects versions 2.17.1 through 2.18, 2.19.1, and 2.19.2.
SOFTWARE:
Bugzilla 2.x
SOLUTION:
Update to version 2.18.1.
http://www.bugzilla.org/download/
The weaknesses have also been fixed in versions 2.16.9 and 2.19.3.
PROVIDED AND/OR DISCOVERED BY:
The vendor credits the following people:
* Roman Pszonka
* Gervase Markham
* Fr?d?ric Buclin
* Myk Melez
* Joel Peshkin
ORIGINAL ADVISORY:
Bugzilla:
http://www.bugzilla.org/security/2.16.8/
https://bugzilla.mozilla.org/show_bug.cgi?id=287109
https://bugzilla.mozilla.org/show_bug.cgi?id=287436
VERIFY ADVISORY:
http://secunia.com/advisories/15338/
Secunia Security Advisories
| 
Contribute :
Advanced Search :
Web Resources :
Polls :
File Repository
