CVE-2008-2105: Low severity bugzilla vulnerability

Published May 7, 2008

Updated

emailin.pl in Bugzilla 2.23.4, 3.0.x before 3.0.4, and 3.1.x before 3.1.4 allows remote authenticated users to more easily spoof the changer of a bug via a @reporter command in the body of an e-mail message, which overrides the e-mail address as normally obtained from the From e-mail header. NOTE: since From headers are easily spoofed, this only crosses privilege boundaries in environments that provide additional verification of e-mail addresses.

Affected Software

70 affected components

Bugzilla=2.16.8

Bugzilla=3.0.0

Bugzilla=2.16_rc2

Bugzilla=3.0.1

Bugzilla=2.17.6

Bugzilla=2.18.5

Bugzilla=2.19.3

Bugzilla=2.20-rc2

Bugzilla=2.18.6

Bugzilla=2.17.2

Bugzilla=2.20-rc1

Bugzilla=2.16.1

Bugzilla=2.18-rc1

Bugzilla=3.1.1

Bugzilla=2.16.2

Bugzilla=3.1.2

Bugzilla=2.16.11

Bugzilla=2.20.5

Bugzilla=2.20.6

Bugzilla=2.22.3

Bugzilla=2.17.4

Bugzilla=2.16-rc1

Bugzilla=2.23.2

Bugzilla=2.21.2

Bugzilla=2.10

Bugzilla=2.17.1

Bugzilla=2.22.1

Bugzilla=2.23.4

Bugzilla=2.16.9

Bugzilla=2.20.1

Bugzilla=2.23.3

Bugzilla=2.14.2

Bugzilla=2.23.1

Bugzilla=2.22.2

Bugzilla=2.18.1

Bugzilla=2.22-rc1

Bugzilla=2.14.3

Bugzilla=2.14.4

Bugzilla=2.19.1

Bugzilla=2.16.7

Bugzilla=2.6

Bugzilla=2.17.5

Bugzilla=2.22

Bugzilla=3.1.0

Bugzilla=2.17.3

Bugzilla=2.4

Bugzilla=2.16.4

Bugzilla=2.12

Bugzilla=2.20.3

Bugzilla=2.8

Bugzilla=3.0.2

Bugzilla=2.18.4

Bugzilla=2.16.3

Bugzilla=2.14.5

Bugzilla=2.18.3

Bugzilla=2.17.7

Bugzilla=2.20.2

Bugzilla=2.20.4

Bugzilla=2.21.1

Bugzilla=2.18-rc3

Bugzilla=2.23

Bugzilla=2.16.6

Bugzilla=2.18.2

Bugzilla=2.18-rc2

Bugzilla=2.14.1

Bugzilla=2.22.4

Bugzilla=2.16.5

Bugzilla=2.14

Bugzilla=2.19.2

Bugzilla=2.16.10

Remediation

Patch Available

https://bugzilla.mozilla.org/show_bug.cgi?id=419188

Event History

May 7, 2008

CVE Published

via MITRE·08:07 PM

Data Sourced

via MITRE·08:07 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-2105?

CVE-2008-2105 has been classified as a moderate severity vulnerability due to its potential for user impersonation.

How do I fix CVE-2008-2105?

To fix CVE-2008-2105, upgrade Bugzilla to version 3.0.4 or later, or to version 3.1.4 or later.

Who is affected by CVE-2008-2105?

CVE-2008-2105 affects Bugzilla versions 2.23.4, 3.0.x before 3.0.4, and 3.1.x before 3.1.4.

What is the nature of the vulnerability in CVE-2008-2105?

CVE-2008-2105 allows remote authenticated users to spoof the changer of a bug using an e-mail command.

Is there a workaround for CVE-2008-2105?

There is no specific workaround for CVE-2008-2105, thus updating to a fixed version is recommended.