CVE-2010-4568: High severity Bugzilla vulnerability

Published Jan 28, 2011

Updated

Bugzilla 2.14 through 2.22.7; 3.0.x, 3.1.x, and 3.2.x before 3.2.10; 3.4.x before 3.4.10; 3.6.x before 3.6.4; and 4.0.x before 4.0rc2 does not properly generate random values for cookies and tokens, which allows remote attackers to obtain access to arbitrary accounts via unspecified vectors, related to an insufficient number of calls to the srand function.

Affected Software

113 affected components

Bugzilla=2.18.6\+

Bugzilla=2.16.8

Bugzilla=2.17.6

Bugzilla=2.16-rc2

Bugzilla=2.18.5

Bugzilla=2.19.3

Bugzilla=2.20-rc2

Bugzilla=2.18.6

Bugzilla=2.20-rc1

Bugzilla=2.16.1

Bugzilla=2.20

Bugzilla=2.19

Bugzilla=2.18-rc1

Bugzilla=2.16.2

Bugzilla=2.16.11

Bugzilla=2.20.5

Bugzilla=2.20.6

Bugzilla=2.22.3

Bugzilla=2.22.6

Bugzilla=2.17.4

Bugzilla=2.16-rc1

Bugzilla=2.21.2

Bugzilla=2.17.1

Bugzilla=2.16

Bugzilla=2.22.1

Bugzilla=2.16.9

Bugzilla=2.20.1

Bugzilla=2.14.2

Bugzilla=2.22.2

Bugzilla=2.18.1

Bugzilla=2.22-rc1

Bugzilla=2.14.3

Bugzilla=2.22.5

Bugzilla=2.14.4

Bugzilla=2.19.1

Bugzilla=2.16.7

Bugzilla=2.17.5

Bugzilla=2.22

Bugzilla=2.17.3

Bugzilla=2.16.4

Bugzilla=2.20.3

Bugzilla=2.18.4

Bugzilla=2.16.3

Bugzilla=2.14.5

Bugzilla=2.18

Bugzilla=2.18.3

Bugzilla=2.17.7

Bugzilla=2.20.7

Bugzilla=2.20.2

Bugzilla=2.20.4

Bugzilla=2.21.1

Bugzilla=2.18-rc3

Bugzilla=2.17

Bugzilla=2.16.6

Bugzilla=2.18.2

Bugzilla=2.18-rc2

Bugzilla=2.14.1

Bugzilla=2.22.4

Bugzilla=2.21

Bugzilla=2.16.5

Bugzilla=2.14

Bugzilla=2.19.2

Bugzilla=2.16.10

Bugzilla=3.0.4

Bugzilla=3.0-rc1

Bugzilla=3.0.0

Bugzilla=3.0.1

Bugzilla=3.0

Bugzilla=3.0.11

Bugzilla=3.0.6

Bugzilla=3.0.7

Bugzilla=3.0.3

Bugzilla=3.0.9

Bugzilla=3.0.2

Bugzilla=3.0.10

Bugzilla=3.0.8

Bugzilla=3.0.5

Bugzilla=3.1.3

Bugzilla=3.1.1

Bugzilla=3.1.2

Bugzilla=3.1.4

Bugzilla=3.1.0

Bugzilla=3.2-rc1

Bugzilla=3.2.6

Bugzilla=3.2.5

Bugzilla=3.2.9

Bugzilla=3.2.3

Bugzilla=3.2.8

Bugzilla=3.2

Bugzilla=3.2.4

Bugzilla=3.2.2

Bugzilla=3.2.7

Bugzilla=3.2-rc2

Bugzilla=3.2.1

Bugzilla=3.4.3

Bugzilla=3.4.2

Bugzilla=3.4.9

Bugzilla=3.4.1

Bugzilla=3.4.4

Bugzilla=3.4.8

Bugzilla=3.4.7

Bugzilla=3.4

Bugzilla=3.4.5

Bugzilla=3.4-rc1

Bugzilla=3.4.6

Bugzilla=3.6.1

Bugzilla=3.6.0

Bugzilla=3.6.3

Bugzilla=3.6

Bugzilla=3.6-rc1

Bugzilla=3.6.2

Bugzilla=4.0-rc1

Bugzilla=4.0

Event History

Jan 28, 2011

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2010-4568?

CVE-2010-4568 is considered a high-severity vulnerability as it allows remote attackers to potentially gain unauthorized access to user accounts.

How do I fix CVE-2010-4568?

To fix CVE-2010-4568, it is recommended to upgrade Bugzilla to version 3.2.10 or later, or to any subsequent release.

Which versions of Bugzilla are affected by CVE-2010-4568?

CVE-2010-4568 affects Bugzilla versions 2.14 through 2.22.7, 3.0.x to 3.2.x before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2.

What type of attacks can exploit CVE-2010-4568?

CVE-2010-4568 can be exploited by attackers to gain access to arbitrary accounts through insufficient random value generation for cookies and tokens.

Is there a workaround for CVE-2010-4568 until I can upgrade?

There are no specific workarounds for CVE-2010-4568; the safest remediation is to apply the appropriate updates as soon as possible.