Lucene search
RootSSV:12301HistorySep 16, 2009 - 12:00 a.m.
Mozilla Bugzilla URL口令信息泄露漏洞
2009-09-1600:00:00
Root
www.seebug.org
18
EPSS
0.003
Percentile
70.9%
BUGTRAQ ID: 36372
CVE(CAN) ID: CVE-2009-3166
Bugzilla是很多软件项目都在使用的基于Web的BUG跟踪系统。
由于$cgi->query_string在不合适的情况下返回了POST变量，用户在重置口令后立即重新登录时，浏览器的URL中会泄露口令，这也意味着Bugzilla Webserver的日志中和登录后立即点击链接的页面Referer头中可能会出现口令。
Mozilla Bugzilla 3.4
厂商补丁：
Mozilla
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：
http://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-3.4.2.tar.gz
Related
cvelist
cvelist
CVE-2009-3166
2009-09-15 22:00:00
openvas
openvas
Bugzilla URL Password Information Disclosure Vulnerability
2010-08-02 00:00:00
Bugzilla URL Password Information Disclosure Vulnerability
2010-08-02 00:00:00
FreeBSD Ports: bugzilla
2009-09-21 00:00:00
ubuntucve
ubuntucve
CVE-2009-3166
2009-09-15 00:00:00
nvd
nvd
CVE-2009-3166
2009-09-15 22:30:00
cve
cve
CVE-2009-3166
2009-09-15 22:30:00
prion
prion
Default credentials
2009-09-15 22:30:00
fedora
fedora
[SECURITY] Fedora 11 Update: bugzilla-3.2.5-1.fc11
2009-09-19 00:06:52
[SECURITY] Fedora 10 Update: bugzilla-3.2.5-1.fc10
2009-09-19 00:11:57
[SECURITY] Fedora 11 Update: bugzilla-3.2.6-2.fc11
2010-02-09 05:10:39
freebsd
freebsd
bugzilla -- two SQL injections, sensitive data exposure
2009-09-11 00:00:00
nessus
nessus
FreeBSD : bugzilla -- two SQL injections, sensitive data exposure (b9ec7fe3-a38a-11de-9c6b-003048818f40)
2009-09-18 00:00:00
Bugzilla < 3.0.9/3.2.5/3.4.2 Multiple Vulnerabilities
2009-09-14 00:00:00
GLSA-201006-19 : Bugzilla: Multiple vulnerabilities
2010-06-04 00:00:00
gentoo
gentoo
Bugzilla: Multiple vulnerabilities
2010-06-04 00:00:00