The remote host is affected by the vulnerability described in GLSA-201006-19 (Bugzilla: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in Bugzilla. Please review     the CVE identifiers referenced below for details.
  Impact :

    A remote attacker might be able to disclose local files, bug     information, passwords, and other data under certain circumstances.
    Furthermore, a remote attacker could conduct SQL injection, Cross-Site     Scripting (XSS) or Cross-Site Request Forgery (CSRF) attacks via     various vectors.
  Workaround :

    There is no known workaround at this time.

- Thu Mar 5 2009 Itamar Reis Peixoto <itamar at     ispbrasil.com.br> 3.2.2-2

    - fix from BZ #474250 Comment #16, from Chris Eveleigh
      -->

    - add python BR for contrib subpackage

    - fix description

    - change Requires perl-SOAP-Lite to perl(SOAP::Lite)       according guidelines

    - Sun Mar 1 2009 Itamar Reis Peixoto <itamar at       ispbrasil.com.br> 3.2.2-1

    - thanks to Chris Eveleigh <chris dot eveleigh at       planningportal dot gov dot uk>

    - for contributing with patches :-)

    - Upgrade to upstream 3.2.2 to fix multiple security       vulns

    - Removed old perl_requires exclusions, added new ones       for RADIUS, Oracle and sanitycheck.cgi

    - Added Oracle to supported DBs in description (and       moved line breaks)

    - Include a patch to fix max_allowed_packet warnin when       using with mysql

    - Sat Feb 28 2009 Itamar Reis Peixoto <itamar at       ispbrasil.com.br> 3.0.8-1

    - Upgrade to 3.0.8, fix #466077 #438080

    - fix macro in changelog rpmlint warning

    - fix files-attr-not-set rpmlint warning for doc and       contrib sub-packages

    - Mon Feb 23 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 3.0.4-4

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild

    - Mon Feb 2 2009 Stepan Kasal <skasal at redhat.com> -       3.0.4-3

    - do not require perl-Email-Simple, it is (no longer) in       use

    - remove several explicit perl-* requires; the automatic       dependencies do handle them

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

リモートホストは、GLSA-201006-19 で説明されている脆弱性による影響を受けます（Bugzilla：複数の脆弱性）

Bugzilla で、複数の脆弱性が報告されました。詳細については、以下で参照されている CVE 識別子をレビューしてください。
 影響：

リモートの攻撃者が、特定の状況でローカルファイル、バグ情報、パスワードなどのデータを漏洩する可能性があります。
 さらに、リモートの攻撃者が、様々なベクトルを通じて、SQL インジェクション、クロスサイトスクリプティング（XSS）またはクロスサイトリクエスト偽造（CSRF）攻撃を仕掛ける可能性があります。
 回避策：

現時点で、既知の回避策はありません。

- Thu Mar 5 2009 Itamar Reis Peixoto <itamar at     ispbrasil.com.br> 3.2.2-2

    - fix from BZ #474250 Comment #16, from Chris Eveleigh
      -->

    - add python BR for contrib subpackage

    - fix description

    - change Requires perl-SOAP-Lite to perl(SOAP::Lite)       according guidelines

    - Sun Mar 1 2009 Itamar Reis Peixoto <itamar at       ispbrasil.com.br> 3.2.2-1

    - thanks to Chris Eveleigh <chris dot eveleigh at       planningportal dot gov dot uk>

    - for contributing with patches :-)

    - Upgrade to upstream 3.2.2 to fix multiple security       vulns

    - Removed old perl_requires exclusions, added new ones       for RADIUS, Oracle and sanitycheck.cgi

    - Added Oracle to supported DBs in description (and       moved line breaks)

    - Include a patch to fix max_allowed_packet warnin when       using with mysql

    - Sat Feb 28 2009 Itamar Reis Peixoto <itamar at       ispbrasil.com.br> 3.0.8-1

    - Upgrade to 3.0.8, fix #466077 #438080

    - fix macro in changelog rpmlint warning

    - fix files-attr-not-set rpmlint warning for doc and       contrib sub-packages

    - Mon Feb 23 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 3.0.4-4

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild

    - Mon Feb 2 2009 Stepan Kasal <skasal at redhat.com> -       3.0.4-3

    - do not require perl-Email-Simple, it is (no longer) in       use

    - remove several explicit perl-* requires; the automatic       dependencies do handle them

  - Mon Jul 14 2008 Tom 'spot' Callaway <tcallawa at     redhat.com> - 3.0.4-2

    - fix license tag

    - Fri May 9 2008 John Berninger <john at ncphotography       dot com> - 3.0.4-1

    - Update to upstream 3.0.4 to fix multiple security       vulns

    - Change perms on /etc/bugzilla for bz 427981

    - Sun May 4 2008 John Berninger <john at ncphotography       dot com> - 3.0.3-0

    - Update to upstream 3.0.3 - bz 444669

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A Bugzilla Security Advisory reports :

When importing bugs using importxml.pl, the --attach_path option can be specified, pointing to the directory where attachments to import are stored. If the XML file being read by importxml.pl contains a malicious ../relative_path/to/local_file node, the script follows this relative path and attaches the local file pointed by it to the bug, making the file public. The security fix makes sure the relative path is always ignored.

ID	名稱	產品	系列	已發布	已更新	嚴重性
46808	GLSA-201006-19 : Bugzilla: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2010/6/4	2021/1/6	high
38079	Fedora 10 : bugzilla-3.2.2-2.fc10 (2009-2417)	Nessus	Fedora Local Security Checks	2009/4/23	2021/1/11	high
46808	GLSA-201006-19：Bugzilla：複数の脆弱性	Nessus	Gentoo Local Security Checks	2010/6/4	2021/1/6	high
35960	Fedora 9 : bugzilla-3.2.2-2.fc9 (2009-2418)	Nessus	Fedora Local Security Checks	2009/3/19	2021/1/11	high
33904	FreeBSD : Bugzilla -- Directory Traversal in importxml.pl (1d96305d-6ae6-11dd-91d5-000c29d47fd7)	Nessus	FreeBSD Local Security Checks	2008/8/17	2021/1/6	high

偵測

搜尋 Plugin

high

high

high

high

high