PT-2013-2613 · Mozilla · Bugzilla

Publicado 2013-02-24 · Atualizado 2013-12-13 · CVE-2013-0786

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bugzilla versions 2.x through 3.6.12 Bugzilla versions 3.7.x Bugzilla versions 4.0.x through 4.0.9

Description The issue allows remote attackers to discover private product names by using debug mode for a query. This is due to the Bugzilla::Search::build subselect function generating different error messages for invalid product queries depending on whether a product exists.

Recommendations For Bugzilla versions 2.x through 3.6.12, update to version 3.6.13 or later. For Bugzilla versions 3.7.x, update to a version that is not affected by this issue. For Bugzilla versions 4.0.x through 4.0.9, update to version 4.0.10 or later.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2013-0786

Produtos afetados

Bugzilla

Referências · 5

• https://bugzilla.mozilla.org/show_bug.cgi?id=824399 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-0786 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0786 · Nota
• http://mandriva.com/security/advisories?name=MDVSA-2013:066 · Aviso do Fabricante
• http://bugzilla.org/security/3.6.12 · Aviso do Fabricante