ADMIN - Explore the new world of system administration! Special introductory offer! Order by September 30th to save 10% off the regular subscription price! Each issue delivers technical solutions to the real-world problems you face every day. Learn the latest techniques for better:
network security
system management
troubleshooting
performance tuning
virtualization
cloud computing
on Windows, Linux, Solaris, and popular varieties of Unix.
The developers of the free Bugzilla bug management system have fixed several bugs including a vulnerability that enabled cross site scripting attacks.
In the current security advisory for the Bugzilla bug management system the developers report that three vulnerabilities have been closed. One bug let attackers trick users into visiting a rogque website if the user viewed bugs in the "Format for Printing", or extended view. For more information on the cross site scripting vulnerability read security report 425665.
An error in the XML-RPC interface gave arbitrary users the ability to create new bug reports with "NEW" or "ASSIGNED" status. Normally users require "canconfirm" privileges for this. The developers classified the third bug as less critical. It gave users the ability to use fake names. A lack of authentication in the "email_in.pl" module gave users the ability to manipulate the FROM header.
The bugs affected Bugzilla prior to version 3.0.4, 3.1.4, 2.22.4 and 2.20.6. Patches and how-tos on fixing the bugs are available on bugzilla.org/download. You can also download a full release from the same site.
Get 3 Issues + 3 DVDs for the price of a single issue!
Let Linux Magazine's hands-on, technical articles guide you in your daily Linux use. Check out bonus DVDs like Ubuntu, SUSE, or Fedora and save the download.
Only available for a limited time. Don't miss out!
Comments