PT-2010-4271 · Mozilla · Bugzilla

Bbaetz + 1 · Published 2010-08-13 · Updated 2010-09-08 · CVE-2010-2757

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bugzilla versions 2.22rc1 through 3.2.7 Bugzilla versions 3.3.1 through 3.4.7 Bugzilla versions 3.5.1 through 3.6.1 Bugzilla versions 3.7 through 3.7.2

Description The issue is related to the sudo feature in Bugzilla, which does not properly send impersonation notifications. This makes it easier for remote authenticated users to impersonate other users without being discovered.

Recommendations For versions 2.22rc1 through 3.2.7, update to a version outside of this range to resolve the issue. For versions 3.3.1 through 3.4.7, update to a version outside of this range to resolve the issue. For versions 3.5.1 through 3.6.1, update to a version outside of this range to resolve the issue. For versions 3.7 through 3.7.2, update to a version outside of this range to resolve the issue.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2010-2757

Affected Products

Bugzilla

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2010-2757 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046518.html · Vendor Advisory
• http://secunia.com/advisories/40892 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046534.html · Vendor Advisory
• http://vupen.com/english/advisories/2010/2035 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046546.html · Vendor Advisory
• http://secunia.com/advisories/41128 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2757 · Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=450013 · Note
• http://securityfocus.com/bid/42275 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=623423 · Note
• http://vupen.com/english/advisories/2010/2205 · Note
• http://bugzilla.org/security/3.2.7 · Note