PT-2002-1114 · Mozilla · Bugzilla

Published 2002-01-31 · Updated 2017-10-10 · CVE-2002-0007

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Bugzilla versions prior to 2.14.1

Description The issue allows remote attackers to obtain an anonymous bind to the LDAP server by sending a request without a password, causing a null password to be sent to the LDAP server. This occurs when using LDAP in CGI.pl.

Recommendations For versions prior to 2.14.1, update to version 2.14.1 or later to resolve the issue.

Fix

Related Identifiers

CVE-2002-0007

Affected Products

Bugzilla

References · 8

• http://bugzilla.mozilla.org/show_bug.cgi?id=54901 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2002-001.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0007 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2002-01/0034.html · Vendor Advisory
• http://securityfocus.com/bid/3792 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7812 · Note
• http://bugzilla.org/security2_14_1.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0007 · Note