Channel News and Analysis - Channel Insider
Empowering the next generation Channel
 
security
Surprising Security Shortcomings After nearly a decade of threat warnings, evolving threats and billions of dollars in technology investments, you’d think that businesses have at least a baseline of IT security protections. Recent reports reveal some surprising security shortcomings in the business community.

Sponsored Links
  • SonicWALL VS Status Quo Solutions. No Contest
  • Sell BlackBerry® Technical Support and earn
  • Ready. Set. 7. See who’s building with Windows 7.
  • Special support for Microsoft partners in today’s economy
  • Green is a huge opportunity with HP PartnerONE


    		•  

    'Moderately Critical' Bugzilla Bugs Squashed

    in Channel News and Analysis

    DATE: 2006-10-16
    By Ryan Naraine

    Article Rating:starstarstarstarstar / 0
    Article Views: 390

    Rate This Article:
    Poor Best
    Add This Article To:
    Flaws in the open-source bug-tracking tool puts users at risk of cross-site scripting, script injection and data manipulation attacks.

    Multiple security flaws in Bugzilla could put users of the software defect tracking software at risk of cross-site scripting, data manipulation and data exposure attacks.

    According to a warning from the open-source Bugzilla project, users should immediately upgrade to versions 2.18.6, 2.20.3, 2.22.1 or 2.23.3 to minimize the risk of malicious attacks.

    Security alerts aggregator Secunia rates the vulnerabilities as "moderately critical."

    Resource Library:

    The most serious vulnerability occurs because Bugzilla does not properly sanitize various fields when embedded in certain HTML headline tags.

    "This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site," Secunia warned.

    Read more here about a Firefox flaw warning hoax.

    A second error that happens when attachments in "diff" mode are viewed could let unauthenticated users read the descriptions of all attachments.

    Additionally, when exporting bugs to the XML format, the "deadline" field is also visible for users, who are not members of the "timetrackinggroup" group. This can be exploited to gain knowledge of potentially sensitive information, the company explained.

    Unpatched versions of Bugzilla also allow users to perform certain sensitive actions via HTTP GET and POST requests without verifying the user's request properly. This can be exploited to modify, delete or create bugs.

    Bugzilla is a free, Web-based tool used by software developers to track code bugs and defects. It was originally developed by the Mozilla Foundation and is widely used in the open-source community.

    Check out eWEEK.com's for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzer's Weblog.





    Discuss 'Moderately Critical' Bugzilla Bugs Squashed
     
    >>> Be the FIRST to comment on this article!
     

     
     
    >>> More Channel News and Analysis Articles          >>> More By Ryan Naraine
     



    		 

    Related Content

    Articles Labs/How-To Multimedia

    SIGN UP FOR CHANNEL INSIDER NEWSLETTERS
    Reliable, timely information on the business of technology. Sign up now.

    RSS SUBSCRIPTIONS
    XML
    Add Channel News, Product Reviews, Trends and Analysis to your RSS newsreader or My Yahoo!

    ZDE Services
    > Ziff Davis Enterprise White Paper Library

    > eWEEK Blogs

     

    CHANNEL RESOURCE CENTER
     
     
    Best Free Antivirus Apps
    Microsoft isn’t the first vendor to offer free antivirus software to consumers and small businesses. Several vendors have free general available versions of their malware protection suites. Their strategy: get customers interested and open opportunity to partners. Here are few worth free AV packages worth considering.
    View Slideshow

    Top 10 Most Profitable Vendor Certifications
    Solution providers that invest in vendor technical certifications are more profitable, sell more complex systems and have better relationships with their customers, according to the new Channel Insider/Amazon Consulting certification study. But not all vendor certifications have the same ROI. The following vendors have the best certifications for return on their partners’ investment.
    View Slideshow
    The IT industry is in the midst of a mass metamorphosis. Lines are blurring between networking technologies, storage, servers, software and telephony. Vendors that represent the tried and true establishment in one discipline are now making hard-right turns into new, largely unfamiliar and often competitive markets. Read on to see just a few of the major convergence plays of the last year.
    View Slideshow