PT-2007-2237 · Apache+1 · Apache+2

Publicado 2007-02-06 · Atualizado 2018-10-16 · CVE-2007-0792

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bugzilla version 2.23.3

Description The issue concerns the mod perl initialization script in Bugzilla, which fails to set the Apache configuration to allow .htaccess permissions to override file permissions. This allows remote attackers to obtain the database username and password by making a direct request for the localconfig file.

Recommendations For Bugzilla version 2.23.3, update the mod perl initialization script to set the Bugzilla Apache configuration and allow .htaccess permissions to override file permissions, or apply the necessary configuration changes to prevent remote access to the localconfig file.

Correção

Identificadores relacionados

CVE-2007-0792

Produtos afetados

Apache

Bugzilla

Mod Perl

Referências · 10

• http://vupen.com/english/advisories/2007/0477 · Nota
• http://securitytracker.com/id?1017585 · Nota
• http://securityreason.com/securityalert/2222 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32252 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0792 · Nota
• http://securityfocus.com/bid/22380 · Nota
• http://securityfocus.com/archive/1/459025/100/0/threaded · Nota
• http://osvdb.org/35862 · Nota
• http://bugzilla.org/security/2.20.3 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-0792 · Nota de Segurança