CVE-2012-3981: Medium severity bugzilla vulnerability

Published Sep 4, 2012

Updated

Auth/Verify/LDAP.pm in Bugzilla 2.x and 3.x before 3.6.11, 3.7.x and 4.0.x before 4.0.8, 4.1.x and 4.2.x before 4.2.3, and 4.3.x before 4.3.3 does not restrict the characters in a username, which might allow remote attackers to inject data into an LDAP directory via a crafted login attempt.

Affected Software

168 affected components

Bugzilla=2.0

Bugzilla=2.2

Bugzilla=2.4

Bugzilla=2.6

Bugzilla=2.8

Bugzilla=2.9

Bugzilla=2.10

Bugzilla=2.12

Bugzilla=2.14

Bugzilla=2.14.1

Bugzilla=2.14.2

Bugzilla=2.14.3

Bugzilla=2.14.4

Bugzilla=2.14.5

Bugzilla=2.16

Bugzilla=2.16-rc1

Bugzilla=2.16-rc2

Bugzilla=2.16.1

Bugzilla=2.16.2

Bugzilla=2.16.3

Bugzilla=2.16.4

Bugzilla=2.16.5

Bugzilla=2.16.6

Bugzilla=2.16.7

Bugzilla=2.16.8

Bugzilla=2.16.9

Bugzilla=2.16.10

Bugzilla=2.16.11

Bugzilla=2.17

Bugzilla=2.17.1

Bugzilla=2.17.2

Bugzilla=2.17.3

Bugzilla=2.17.4

Bugzilla=2.17.5

Bugzilla=2.17.6

Bugzilla=2.17.7

Bugzilla=2.18

Bugzilla=2.18-rc1

Bugzilla=2.18-rc2

Bugzilla=2.18-rc3

Bugzilla=2.18.1

Bugzilla=2.18.2

Bugzilla=2.18.3

Bugzilla=2.18.4

Bugzilla=2.18.5

Bugzilla=2.18.6

Bugzilla=2.18.6\+

Bugzilla=2.18.7

Bugzilla=2.18.8

Bugzilla=2.18.9

Bugzilla=2.19

Bugzilla=2.19.1

Bugzilla=2.19.2

Bugzilla=2.19.3

Bugzilla=2.20

Bugzilla=2.20-rc1

Bugzilla=2.20-rc2

Bugzilla=2.20.1

Bugzilla=2.20.2

Bugzilla=2.20.3

Bugzilla=2.20.4

Bugzilla=2.20.5

Bugzilla=2.20.6

Bugzilla=2.20.7

Bugzilla=2.21

Bugzilla=2.21.1

Bugzilla=2.21.2

Bugzilla=2.21.2-rc1

Bugzilla=2.22

Bugzilla=2.22-rc1

Bugzilla=2.22.1

Bugzilla=2.22.2

Bugzilla=2.22.3

Bugzilla=2.22.4

Bugzilla=2.22.5

Bugzilla=2.22.6

Bugzilla=2.22.7

Bugzilla=2.23

Bugzilla=2.23.1

Bugzilla=2.23.2

Bugzilla=2.23.3

Bugzilla=2.23.4

Bugzilla=3.0

Bugzilla=3.0-rc1

Bugzilla=3.0.0

Bugzilla=3.0.1

Bugzilla=3.0.2

Bugzilla=3.0.3

Bugzilla=3.0.4

Bugzilla=3.0.5

Bugzilla=3.0.6

Bugzilla=3.0.7

Bugzilla=3.0.8

Bugzilla=3.0.9

Bugzilla=3.0.10

Bugzilla=3.0.11

Bugzilla=3.1.0

Bugzilla=3.1.1

Bugzilla=3.1.2

Bugzilla=3.1.3

Bugzilla=3.1.4

Bugzilla=3.2

Bugzilla=3.2-rc1

Bugzilla=3.2-rc2

Bugzilla=3.2.1

Bugzilla=3.2.2

Bugzilla=3.2.3

Bugzilla=3.2.4

Bugzilla=3.2.5

Bugzilla=3.2.6

Bugzilla=3.2.7

Bugzilla=3.2.8

Bugzilla=3.2.9

Bugzilla=3.2.10

Bugzilla=3.3

Bugzilla=3.3.1

Bugzilla=3.3.2

Bugzilla=3.3.3

Bugzilla=3.3.4

Bugzilla=3.4

Bugzilla=3.4-rc1

Bugzilla=3.4.1

Bugzilla=3.4.2

Bugzilla=3.4.3

Bugzilla=3.4.4

Bugzilla=3.4.5

Bugzilla=3.4.6

Bugzilla=3.4.7

Bugzilla=3.4.8

Bugzilla=3.4.9

Bugzilla=3.4.10

Bugzilla=3.4.11

Bugzilla=3.4.12

Bugzilla=3.4.13

Bugzilla=3.5

Bugzilla=3.5.1

Bugzilla=3.5.2

Bugzilla=3.5.3

Bugzilla=3.6

Bugzilla=3.6-rc1

Bugzilla=3.6.0

Bugzilla=3.6.1

Bugzilla=3.6.2

Bugzilla=3.6.3

Bugzilla=3.6.4

Bugzilla=3.6.5

Bugzilla=3.6.6

Bugzilla=3.6.7

Bugzilla=3.6.8

Bugzilla=3.6.9

Bugzilla=3.6.10

Bugzilla=3.7

Bugzilla=3.7.1

Bugzilla=3.7.2

Bugzilla=3.7.3

Bugzilla=4.0.7

Bugzilla=4.1

Bugzilla=4.1.1

Bugzilla=4.1.2

Bugzilla=4.1.3

Bugzilla=4.2

Bugzilla=4.2-rc1

Bugzilla=4.2-rc2

Bugzilla=4.2.1

Bugzilla=4.2.2

Bugzilla=4.3

Bugzilla=4.3.1

Bugzilla=4.3.2

Remediation

Patch Available

http://www.bugzilla.org/security/3.6.10/

Event History

Sep 4, 2012

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2012-3981?

CVE-2012-3981 is considered a medium severity vulnerability affecting Bugzilla, primarily due to the potential for LDAP injection.

How do I fix CVE-2012-3981?

To fix CVE-2012-3981, upgrade Bugzilla to version 3.6.11 or later for the affected 3.x branches, or to 4.0.8 or later for the affected 4.x branches.

What types of attacks can exploit CVE-2012-3981?

CVE-2012-3981 can be exploited through crafted login attempts that inject malicious data into an LDAP directory.

Which versions of Bugzilla are affected by CVE-2012-3981?

CVE-2012-3981 affects Bugzilla versions prior to 3.6.11, 4.0.8, 4.2.3, and 4.3.3.

Is there a workaround for CVE-2012-3981 if I cannot apply a patch?

There are no specific workarounds for CVE-2012-3981, and it is strongly recommended to update to a patched version.