PT-2008-5675 · Mozilla · Bugzilla

Ilja · Published 2008-10-03 · Updated 2017-08-08 · CVE-2008-4437

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Bugzilla versions prior to 2.22.5 Bugzilla versions 3.x prior to 3.0.5

Description: A directory traversal issue exists when the --attach path option is enabled, allowing remote attackers to read arbitrary files by including a .. (dot dot) in the data element of an XML file.

Recommendations: For versions prior to 2.22.5, update to version 2.22.5 or later. For versions 3.x prior to 3.0.5, update to version 3.0.5 or later. As a temporary workaround, consider disabling the --attach path option until a patch is available.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-4437

DTSA-170-1

Affected Products

Bugzilla

References · 13

• 🔥 https://exploit-db.com/exploits/32228 · Exploit
• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=437169 · Exploit
• 🔥 http://securityfocus.com/bid/30661 · Exploit
• http://secunia.com/advisories/31444 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-March/msg00687.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-4437 · Security Note
• https://redhat.com/archives/fedora-package-announce/2009-March/msg00664.html · Vendor Advisory
• http://secunia.com/advisories/34361 · Note
• http://bugzilla.org/security/2.22.4 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4437 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44407 · Note
• http://securitytracker.com/id?1020668 · Note
• http://vupen.com/english/advisories/2008/2344 · Note