CVE-2002-1196: High severity Bugzilla vulnerability

Published Oct 28, 2002

Updated

editproducts.cgi in Bugzilla 2.14.x before 2.14.4, and 2.16.x before 2.16.1, when the "usebuggroups" feature is enabled and more than 47 groups are specified, does not properly calculate bit values for large numbers, which grants extra permissions to users via known features of Perl math that set multiple bits.

Affected Software

5 affected components

Bugzilla=2.16

Bugzilla=2.14.2

Bugzilla=2.14.3

Bugzilla=2.14.1

Bugzilla=2.14

Remediation

Patch Available

http://www.debian.org/security/2002/dsa-173

Event History

Oct 28, 2002

CVE Published

05:00 AM

Sep 1, 2004

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2002-1196?

CVE-2002-1196 has been classified as a moderate severity vulnerability due to its potential to grant extra permissions to users.

What software versions are vulnerable to CVE-2002-1196?

CVE-2002-1196 affects Bugzilla versions 2.14.x before 2.14.4 and 2.16.x before 2.16.1 when the "usebuggroups" feature is enabled.

How do I fix CVE-2002-1196?

To fix CVE-2002-1196, upgrade Bugzilla to version 2.14.4 or 2.16.1 or later.

What causes the vulnerability in CVE-2002-1196?

CVE-2002-1196 is caused by incorrect bit value calculations for large numbers in the editproducts.cgi script.

What is the impact of not addressing CVE-2002-1196?

Failing to address CVE-2002-1196 may allow unauthorized users to gain elevated permissions in Bugzilla.