PT-2014-4225 · Mozilla · Bugzilla

Published 2014-10-09 · Updated 2024-06-15 · CVE-2014-1572

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Bugzilla versions 2.x through 4.0.x before 4.0.15 Bugzilla versions 4.1.x and 4.2.x before 4.2.11 Bugzilla versions 4.3.x and 4.4.x before 4.4.6 Bugzilla versions 4.5.x before 4.5.6

Description The issue arises from the confirm create account function in the account-creation feature, which fails to specify a scalar context for the realname parameter. This allows remote attackers to create accounts with unverified e-mail addresses by sending three realname values, with realname=login name as the second value. This can be exploited by selecting an e-mail address with a domain name for which group privileges are automatically granted.

Recommendations For Bugzilla versions 2.x through 4.0.x before 4.0.15, update to version 4.0.15 or later. For Bugzilla versions 4.1.x and 4.2.x before 4.2.11, update to version 4.2.11 or later. For Bugzilla versions 4.3.x and 4.4.x before 4.4.6, update to version 4.4.6 or later. For Bugzilla versions 4.5.x before 4.5.6, update to version 4.5.6 or later. As a temporary workaround, consider restricting access to the account-creation feature until the issue is resolved.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-1572

MGASA-2014-0412

OPENSUSE-SU-2024:10860-1

Affected Products

Bugzilla

References · 35

• https://osv.dev/vulnerability/openSUSE-SU-2024:10860-1 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-November/142524.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-1572 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2014:200 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0412.html · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0412 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141309.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141321.html · Vendor Advisory
• https://security.gentoo.org/glsa/201607-11 · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1074812 · Patch
• http://bugzilla.org/security/4.0.14 · Vendor Advisory
• https://suse.com/security/cve/CVE-2008-0169 · Note
• https://suse.com/security/cve/CVE-2012-0220 · Note
• http://reddit.com/r/netsec/comments/2ihen0/new_class_of_vulnerability_in_perl_web · Note
• http://openwall.com/lists/oss-security/2014/10/07/20 · Note