PT-2005-2542 · Mozilla · Bugzilla

Frédéric Buclin + 1 · Publicado 2005-05-14 · Atualizado 2016-10-18 · CVE-2005-1563

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bugzilla versions 2.10 through 2.18 Bugzilla version 2.19.1 Bugzilla version 2.19.2

Description The issue allows remote attackers to determine hidden products by exploiting a difference in error messages displayed by the software, depending on whether a product exists or not.

Recommendations For Bugzilla versions 2.10 through 2.18, update to a version that does not display different error messages based on product existence to prevent exploitation. For Bugzilla version 2.19.1, modify the error message handling to prevent disclosure of hidden products. For Bugzilla version 2.19.2, adjust the product existence check to return a uniform error message, preventing attackers from determining hidden products.

Correção

Identificadores relacionados

CVE-2005-1563

Produtos afetados

Bugzilla

Referências · 10

• http://bugzilla.org/security/2.16.8 · Aviso do Fabricante
• https://bugzilla.mozilla.org/show_bug.cgi?id=287109 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=111592031902962&w=2 · Nota
• http://securityfocus.com/bid/13606 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1563 · Nota
• http://osvdb.org/16425 · Aviso do Fabricante
• http://vupen.com/english/advisories/2005/0533 · Nota
• http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=001040 · Aviso do Fabricante
• http://secunia.com/advisories/15338 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-1563 · Nota de Segurança