PT-2002-2178 · Mozilla · Bugzilla

Published 2002-10-28 · Updated 2016-10-18 · CVE-2002-1196

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Bugzilla versions 2.14.x through 2.14.3 Bugzilla versions 2.16.x through 2.16.0

Description: The issue arises in the editproducts.cgi script of Bugzilla when the usebuggroups feature is enabled and more than 47 groups are specified. It fails to properly calculate bit values for large numbers due to known features of Perl math, which can set multiple bits. This miscalculation grants extra permissions to users.

Recommendations: For Bugzilla versions 2.14.x through 2.14.3, update to version 2.14.4 or later. For Bugzilla versions 2.16.x through 2.16.0, update to version 2.16.1 or later.

Fix

Related Identifiers

CVE-2002-1196

DSA-173

Affected Products

Bugzilla

References · 7

• http://debian.org/security/2002/dsa-173 · Vendor Advisory
• http://iss.net/security_center/static/10233.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1196 · Security Note
• http://securityfocus.com/bid/5843 · Note
• http://bugzilla.mozilla.org/show_bug.cgi?id=167485#c12 · Note
• http://marc.info/?l=bugtraq&m=103349804226566&w=2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1196 · Note