CVE-2009-0486: CSRF

Published Feb 9, 2009

Updated

Bugzilla 3.2.1, 3.0.7, and 3.3.2, when running under modperl, calls the srand function at startup time, which causes Apache children to have the same seed and produce insufficiently random numbers for random tokens, which allows remote attackers to bypass cross-site request forgery (CSRF) protection mechanisms and conduct unauthorized activities as other users.

Affected Software

3 affected components

Bugzilla=3.3.2

Bugzilla=3.0.7

Bugzilla=3.2.1

Event History

Feb 9, 2009

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Data Sourced

via NVD·05:30 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2009-0486?

CVE-2009-0486 has a medium severity rating due to its potential to allow remote attackers to bypass CSRF protection.

How do I fix CVE-2009-0486?

To fix CVE-2009-0486, update Bugzilla to a version that is not affected, such as 3.4 or later.

Which versions of Bugzilla are affected by CVE-2009-0486?

Versions 3.2.1, 3.0.7, and 3.3.2 of Bugzilla are affected by CVE-2009-0486.

What type of attack does CVE-2009-0486 facilitate?

CVE-2009-0486 facilitates attacks that could allow the bypassing of cross-site request forgery (CSRF) protections.

Is CVE-2009-0486 specific to certain environments?

Yes, CVE-2009-0486 is specifically an issue when Bugzilla is running under mod_perl.