PT-2010-1994 · Mozilla · Bugzilla

Daniel Piddock · Published 2010-06-28 · Updated 2010-06-28 · CVE-2010-0180

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bugzilla versions 3.5.1 through 3.7

Description The issue allows local users to read sensitive configuration fields due to world-readable permissions for the localconfig files when use suexec is enabled. This can be demonstrated by accessing the database password field and the site wide secret field.

Recommendations For Bugzilla versions 3.5.1 through 3.7, consider changing the permissions of the localconfig files to prevent world-readable access when use suexec is enabled. As a temporary workaround, restrict access to the localconfig files to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-0180

Affected Products

Bugzilla

References · 7

• http://vupen.com/english/advisories/2010/1595 · Vendor Advisory
• http://secunia.com/advisories/40300 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0180 · Security Note
• http://bugzilla.org/security/3.2.6 · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=561797 · Note
• http://securityfocus.com/bid/41144 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0180 · Note