Bugzilla Information Disclosure Weaknesses

SA38443

CVE-2009-3387, CVE-2009-3989

01 Feb 2010

Less Critical

Vendor Patch

Bugzilla 3.x

From remote

Exposure of sensitive information

Vulnerabilities where documents or credentials are leaked or can be revealed either locally or from remote.

Some weaknesses have been reported in Bugzilla, which can lead to the disclosure of sensitive information.

1) Bugzilla does not restrict access to the "CVS/", "contrib/", "docs/en/xml/", and "t/" directories and the "old-params.txt" file, which may contain sensitive information.

Note: By default, these locations do not contain any sensitive information.

This weakness is reported in all versions prior to 3.0.11, 3.2.6, 3.4.5, and 3.5.3.

2) An error within the group restriction when moving restricted bugs from one product to another can lead to unrestricted bugs, if e.g. no group is used in both products and no other group restrictions apply.

This weakness is reported in versions 3.3.1 to 3.4.4, 3.5.1, and 3.5.2.

Update to version 3.0.11, 3.2.6, 3.4.5, or 3.5.3.
http://www.bugzilla.org/download/

1) Joel Peshkin and Frédéric Buclin
2) Frédéric Buclin

http://www.bugzilla.org/security/3.0.10/