PT-2011-1607 · Mozilla · Bugzilla

Max Kanat-Alexander · Published 2011-01-28 · Updated 2017-08-17 · CVE-2010-4568

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bugzilla versions 2.14 through 2.22.7 Bugzilla versions 3.0.x through 3.2.x before 3.2.10 Bugzilla versions 3.4.x before 3.4.10 Bugzilla versions 3.6.x before 3.6.4 Bugzilla versions 4.0.x before 4.0rc2

Description The issue is related to the insufficient generation of random values for cookies and tokens, allowing remote attackers to obtain access to arbitrary accounts. This is due to an insufficient number of calls to the srand function.

Recommendations For versions 2.14 through 2.22.7, update to a version after 2.22.7 to resolve the issue. For versions 3.0.x through 3.2.x before 3.2.10, update to version 3.2.10 or later. For versions 3.4.x before 3.4.10, update to version 3.4.10 or later. For versions 3.6.x before 3.6.4, update to version 3.6.4 or later. For versions 4.0.x before 4.0rc2, update to version 4.0rc2 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-4568

DSA-2322-1

Affected Products

Bugzilla

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2010-4568 · Security Note
• http://secunia.com/advisories/43033 · Vendor Advisory
• http://debian.org/security/2011/dsa-2322 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053665.html · Vendor Advisory
• http://vupen.com/english/advisories/2011/0207 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053678.html · Vendor Advisory
• http://bugzilla.org/security/3.2.9 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4568 · Note
• http://vupen.com/english/advisories/2011/0271 · Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=621591 · Note
• https://bugzilla.mozilla.org/attachment.cgi?id=506031&action=diff · Note
• http://securityfocus.com/bid/45982 · Note
• http://osvdb.org/70700 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65001 · Note
• http://secunia.com/advisories/43165 · Note