PT-2007-2237 · Apache+1 · Apache+2

Published 2007-02-06 · Updated 2018-10-16 · CVE-2007-0792

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bugzilla version 2.23.3

Description The issue concerns the mod perl initialization script in Bugzilla, which fails to set the Apache configuration to allow .htaccess permissions to override file permissions. This allows remote attackers to obtain the database username and password by making a direct request for the localconfig file.

Recommendations For Bugzilla version 2.23.3, update the mod perl initialization script to set the Bugzilla Apache configuration and allow .htaccess permissions to override file permissions, or apply the necessary configuration changes to prevent remote access to the localconfig file.

Fix

Related Identifiers

CVE-2007-0792

Affected Products

Apache

Bugzilla

Mod Perl

References · 10

• http://bugzilla.org/security/2.20.3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-0792 · Security Note
• http://vupen.com/english/advisories/2007/0477 · Note
• http://securitytracker.com/id?1017585 · Note
• http://securityreason.com/securityalert/2222 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32252 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0792 · Note
• http://securityfocus.com/bid/22380 · Note
• http://securityfocus.com/archive/1/459025/100/0/threaded · Note
• http://osvdb.org/35862 · Note