PT-2012-2586 · Mozilla · Bugzilla

Soroush Dalili · Published 2012-04-27 · Updated 2012-08-14 · CVE-2012-0465

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bugzilla versions 3.5.x through 3.6.8 Bugzilla versions 3.7.x through 4.0.5 Bugzilla versions 4.1.x through 4.2.0

Description The issue allows remote attackers to bypass the lockout policy. This can be achieved via a series of authentication requests with different IP address strings in the X-Forwarded-For HTTP header or a long string in this header. The estimated number of potentially affected devices and details about real-world incidents are not provided.

Recommendations For Bugzilla versions 3.5.x through 3.6.8, update to version 3.6.9 or later. For Bugzilla versions 3.7.x through 4.0.5, update to version 4.0.6 or later. For Bugzilla versions 4.1.x through 4.2.0, update to version 4.2.1 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-0465

Affected Products

Bugzilla

References · 7

• http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079604.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079432.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-0465 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079481.html · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=728639 · Patch
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0465 · Note
• http://archives.neohapsis.com/archives/bugtraq/2012-04/0135.html · Note