CVE-2003-0603: Low severity Bugzilla vulnerability
Bugzilla 2.16.x before 2.16.3, 2.17.x before 2.17.4, and earlier versions allows local users to overwrite arbitrary files via a symlink attack on temporary files that are created in directories with group-writable or world-writable permissions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove group-writable and world-writable permissions from any directory Bugzilla uses to create temporary files. For each directory run: chmod go-w <directory> and ensure the directory is owned by the Bugzilla process user so only that user can create files there.
Bugzilla (directories used for temporary files) permissions = remove group and world write (chmod go-w) - Operational
Locate and audit directories used by Bugzilla for temporary file creation; for each directory that is group-writable or world-writable, remove the group/world write bit and verify temporary files are created only in secured directories. After remediation, confirm that local users cannot overwrite arbitrary files via symlink attacks against those temporary directories.
Event History
Frequently Asked Questions
What is the severity of CVE-2003-0603?
CVE-2003-0603 is considered a moderate severity vulnerability due to its potential for local file manipulation.
How do I fix CVE-2003-0603?
To fix CVE-2003-0603, update Bugzilla to version 2.16.3 or 2.17.4 or later.
What types of systems are affected by CVE-2003-0603?
CVE-2003-0603 affects Bugzilla versions up to 2.16.2 and 2.17.x before 2.17.4.
Can CVE-2003-0603 be exploited remotely?
No, CVE-2003-0603 can only be exploited by local users with appropriate access.
What are the implications of CVE-2003-0603?
The implications of CVE-2003-0603 include the risk of unauthorized overwriting of files on affected systems.