PT-2010-5052 · Mozilla · Bugzilla

Philip Gillissen · Published 2010-11-05 · Updated 2017-08-17 · CVE-2010-3764

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bugzilla versions 2.12 through 3.2.8 Bugzilla version 3.4.8 Bugzilla version 3.6.2 Bugzilla version 3.7.3 Bugzilla version 4.1

Description The issue allows remote attackers to obtain sensitive information via a modified URL, due to the predictable names of graph files created by the Old Charts implementation in Bugzilla.

Recommendations For Bugzilla versions 2.12 through 3.2.8, consider restricting access to the graphs/ directory to minimize the risk of exploitation. For Bugzilla version 3.4.8, update the Old Charts implementation to use unpredictable file names. For Bugzilla version 3.6.2, restrict access to sensitive information via modified URLs. For Bugzilla version 3.7.3, implement a secure naming convention for graph files. For Bugzilla version 4.1, apply configuration changes to prevent remote attackers from obtaining sensitive information.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2010-3764

Affected Products

Bugzilla

References · 12

• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=419014 · Exploit
• http://vupen.com/english/advisories/2010/2878 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050813.html · Vendor Advisory
• http://bugzilla.org/security/3.2.8 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050830.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050820.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3764 · Security Note
• http://vupen.com/english/advisories/2010/2975 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3764 · Note
• http://securitytracker.com/id?1024683 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/62969 · Note
• http://secunia.com/advisories/42271 · Note