Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Informations | |||
|---|---|---|---|
| Name | CVE-2009-3165 | First vendor Publication | 2009-09-15 |
| Vendor | Cve | Last vendor Modification | 2009-09-16 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| SQL injection vulnerability in the Bug.create WebService function in Bugzilla 2.23.4 through 3.0.8, 3.1.1 through 3.2.4, and 3.3.1 through 3.4.1 allows remote attackers to execute arbitrary SQL commands via unspecified parameters. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3165 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-89 | Improper Sanitization of Special Elements used in an SQL Command ('SQL Injection') (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:13667 | |||
| Oval ID: | oval:org.mitre.oval:def:13667 | ||
| Title: | DSA-1913-1 bugzilla -- SQL injection vulnerability | ||
| Description: | Max Kanat-Alexander, Bradley Baetz, and Frédéric Buclin discovered an SQL injection vulnerability in the Bug.create WebService function in Bugzilla, a web-based bug tracking system, which allows remote attackers to execute arbitrary SQL commands. For the stable distribution, this problem has been fixed in version 3.0.4.1-2+lenny2. The oldstable distribution isn’t affected by this problem. For the testing distribution and the unstable distribution , this problem will be fixed soon. We recommend that you upgrade your bugzilla packages. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1913-1 CVE-2009-3165 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 5.0 | Product(s): | bugzilla |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:7942 | |||
| Oval ID: | oval:org.mitre.oval:def:7942 | ||
| Title: | DSA-1913 bugzilla -- SQL injection vulnerability | ||
| Description: | Max Kanat-Alexander, Bradley Baetz, and Frédéric Buclin discovered an SQL injection vulnerability in the Bug.create WebService function in Bugzilla, a web-based bug tracking system, which allows remote attackers to execute arbitrary SQL commands. The oldstable distribution (etch) isn't affected by this problem. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1913 CVE-2009-3165 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 5.0 | Product(s): | bugzilla |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2011-03-09 | Name : Gentoo Security Advisory GLSA 201006-19 (bugzilla) File : nvt/glsa_201006_19.nasl |
| 2010-03-02 | Name : Fedora Update for bugzilla FEDORA-2010-1458 File : nvt/gb_fedora_2010_1458_bugzilla_fc11.nasl |
| 2009-10-27 | Name : Debian Security Advisory DSA 1913-1 (bugzilla) File : nvt/deb_1913_1.nasl |
| 2009-10-02 | Name : Mozilla Bugzilla 'Bug.create()' WebService Function SQL Injection Vulnerability File : nvt/bugzilla_36373.nasl |
| 2009-09-21 | Name : Fedora Core 10 FEDORA-2009-9550 (bugzilla) File : nvt/fcore_2009_9550.nasl |
| 2009-09-21 | Name : Fedora Core 11 FEDORA-2009-9554 (bugzilla) File : nvt/fcore_2009_9554.nasl |
| 2009-09-21 | Name : FreeBSD Ports: bugzilla File : nvt/freebsd_bugzilla7.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 58088 | Bugzilla Bug.create WebService Function Unspecified SQL Injection Bugzilla contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the Bug.create WebService function not properly sanitizing user-supplied input to an unspecified variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2010-06-04 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201006-19.nasl - Type : ACT_GATHER_INFO |
| 2010-02-24 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1913.nasl - Type : ACT_GATHER_INFO |
| 2009-09-21 | Name : The remote Fedora host is missing a security update. File : fedora_2009-9550.nasl - Type : ACT_GATHER_INFO |
| 2009-09-21 | Name : The remote Fedora host is missing a security update. File : fedora_2009-9554.nasl - Type : ACT_GATHER_INFO |
| 2009-09-18 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_b9ec7fe3a38a11de9c6b003048818f40.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
| Source | Url |
|---|---|
| BID | http://www.securityfocus.com/bid/36373 |
| CONFIRM | http://www.bugzilla.org/security/3.0.8/ https://bugzilla.mozilla.org/show_bug.cgi?id=515191 |
| SECUNIA | http://secunia.com/advisories/36718 |
Alert History
| Date | Informations |
|---|---|
| 2021-05-04 12:10:11 |
|
| 2021-04-22 01:10:36 |
|
| 2020-05-23 00:24:18 |
|
| 2016-04-26 19:06:11 |
|
| 2014-02-17 10:51:36 |
|
| 2013-05-10 23:57:16 |
|
