PT-2003-1740 · Mozilla · Bugzilla

Jouni Heikniemi · Published 2003-07-29 · Updated 2008-09-05 · CVE-2003-0603

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Bugzilla versions 2.16.x through 2.16.2 Bugzilla versions 2.17.x through 2.17.3 Bugzilla versions prior to 2.16.x

Description: The issue allows local users to overwrite arbitrary files via a symlink attack on temporary files created in directories with group-writable or world-writable permissions.

Recommendations: For Bugzilla versions 2.16.x through 2.16.2, update to version 2.16.3 or later. For Bugzilla versions 2.17.x through 2.17.3, update to version 2.17.4 or later. For Bugzilla versions prior to 2.16.x, update to version 2.16.3 or later.

Fix

Related Identifiers

CVE-2003-0603

Affected Products

Bugzilla

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2003-0603 · Security Note
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000653 · Vendor Advisory
• http://securityfocus.com/bid/7412 · Vendor Advisory
• http://bugzilla.org/security/2.16.2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0603 · Note