HTTP: Bugzilla Account Privilege Escalation

This signature detects attempts to exploit a known vulnerability in Bugzilla. Versions 2.14 and earlier are vulnerable. Attackers can send a maliciously crafted URL to elevate their Bugzilla account privileges; attackers can use their new status to perform more severe attacks.

Extended Description

Bugzilla is the bug tracking software package by the Mozilla project. It can be configured to run on Microsoft Windows and various Unix/Linux platforms. A vulnerability exists in the buglist.cgi script which may allow a remote attacker to modify the logic of an SQL query. Due to lack of input validation, it is possible to append arbitrary SQL to the WHERE part of a query. This may permit to the attacker to execute commands on the database.

Affected Products

Mozilla bugzilla

References

BugTraq: 3801

CVE: CVE-2002-0010

URL: http://rhn.redhat.com/errata/RHSA-2002-001.html http://nvd.nist.gov/nvd.cfm?cvename=CVE-2002-0010 http://www.iss.net/security_center/static/7807.php

Short Name

HTTP:CGI:BUGZILLA:PRIV-UP

Severity

Warning

Recommended

False

Recommended Action

None

HTTP: Bugzilla Account Privilege Escalation

Extended Description

Affected Products

References

Found a potential security threat?