PT-2008-5675 · Mozilla · Bugzilla

Ilja · Publicado 2008-10-03 · Atualizado 2017-08-08 · CVE-2008-4437

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Bugzilla versions prior to 2.22.5 Bugzilla versions 3.x prior to 3.0.5

Description: A directory traversal issue exists when the --attach path option is enabled, allowing remote attackers to read arbitrary files by including a .. (dot dot) in the data element of an XML file.

Recommendations: For versions prior to 2.22.5, update to version 2.22.5 or later. For versions 3.x prior to 3.0.5, update to version 3.0.5 or later. As a temporary workaround, consider disabling the --attach path option until a patch is available.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-4437

DTSA-170-1

Produtos afetados

Bugzilla

Referências · 13

• 🔥 https://exploit-db.com/exploits/32228 · Exploit
• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=437169 · Exploit
• 🔥 http://securityfocus.com/bid/30661 · Exploit
• http://secunia.com/advisories/34361 · Nota
• http://bugzilla.org/security/2.22.4 · Nota
• http://secunia.com/advisories/31444 · Aviso do Fabricante
• https://redhat.com/archives/fedora-package-announce/2009-March/msg00687.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-4437 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4437 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44407 · Nota
• https://redhat.com/archives/fedora-package-announce/2009-March/msg00664.html · Aviso do Fabricante
• http://securitytracker.com/id?1020668 · Nota
• http://vupen.com/english/advisories/2008/2344 · Nota