CVE-2003-0013
Current Description
The default .htaccess scripts for Bugzilla 2.14.x before 2.14.5, 2.16.x before 2.16.2, and 2.17.x before 2.17.3 do not include filenames for backup copies of the localconfig file that are made from editors such as vi and Emacs, which could allow remote attackers to obtain a database password by directly accessing the backup file.
Basic Data
| Published | January 17, 2003 |
|---|
| Last Modified | October 18, 2016 |
|---|
| Assigner | cve@mitre.org |
|---|
| Data Type | CVE |
|---|
| Data Format | MITRE |
|---|
| Data Version | 4.0 |
|---|
| Problem Type | NVD-CWE-Other |
|---|
| CVE Data Version | 4.0 |
|---|
Base Metric V2
| CVSS 2 - Version | 2.0 |
|---|
| CVSS 2 - Vector String | AV:N/AC:L/Au:N/C:P/I:P/A:P |
|---|
| CVSS 2 - Access Vector | NETWORK |
|---|
| CVSS 2 - Access Complexity | LOW |
|---|
| CVSS 2 - Authentication | NONE |
|---|
| CVSS 2 - Confidentiality Impact | PARTIAL |
|---|
| CVSS 2 - Availability Impact | PARTIAL |
|---|
| CVSS 2 - Base Score | 7.5 |
|---|
| Severity | HIGH |
|---|
| Exploitability Score | 10.0 |
|---|
| Impact Score | 6.4 |
|---|
| Obtain All Privilege | false |
|---|
| Obtain User Privilege | false |
|---|
| Obtain Other Privilege | true |
|---|
Base Metric V3
No data provided.
Configurations
-
OR - Configuration 1
| Cpe Version | Part | Vendor | Product | Version | Update | Edition | Language | SW Edition | Target SW | Target HW | Other | Version Start Including | Version End Including | Version Start Excluding | Version End Excluding |
|---|
| 2.3 | Application | Mozilla | Bugzilla | 2.14 | * | * | * | * | * | * | * | | | | |
| 2.3 | Application | Mozilla | Bugzilla | 2.14.1 | * | * | * | * | * | * | * | | | | |
| 2.3 | Application | Mozilla | Bugzilla | 2.14.2 | * | * | * | * | * | * | * | | | | |
| 2.3 | Application | Mozilla | Bugzilla | 2.14.3 | * | * | * | * | * | * | * | | | | |
| 2.3 | Application | Mozilla | Bugzilla | 2.14.4 | * | * | * | * | * | * | * | | | | |
| 2.3 | Application | Mozilla | Bugzilla | 2.16 | * | * | * | * | * | * | * | | | | |
| 2.3 | Application | Mozilla | Bugzilla | 2.16.1 | * | * | * | * | * | * | * | | | | |
| 2.3 | Application | Mozilla | Bugzilla | 2.17 | * | * | * | * | * | * | * | | | | |
| 2.3 | Application | Mozilla | Bugzilla | 2.17.1 | * | * | * | * | * | * | * | | | | |
Vulnerable Software List
| Vendor | Product | Versions |
| Mozilla
|
Bugzilla |
2.14, 2.14.1, 2.14.2, 2.14.3, 2.14.4, 2.16, 2.16.1, 2.17, 2.17.1 |
References
| Name | Source | URL | Tags |
|---|
| 20030102 [BUGZILLA] Security Advisory - remote database password disclosure | http://marc.info/?l=bugtraq&m=104154319200399&w=2 | BUGTRAQ | |
| DSA-230 | http://www.debian.org/security/2003/dsa-230 | DEBIAN | Patch Vendor Advisory |
| bugzilla-htaccess-database-password(10970) | http://www.iss.net/security_center/static/10970.php | XF | |
| 6351 | http://www.osvdb.org/6351 | OSVDB | |
| 6501 | http://www.securityfocus.com/bid/6501 | BID | |
Follow @discotekdotca