CVE-ID

CVE-2001-0329
Learn more at National Vulnerability Database (NVD)
• CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Bugzilla 2.10 allows remote attackers to execute arbitrary commands via shell metacharacters in a username that is then processed by (1) the Bugzilla_login cookie in post_bug.cgi, or (2) the who parameter in process_bug.cgi.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
Assigning CNA
MITRE Corporation
Date Record Created
20010427 Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Modified (20011130)
Votes (Legacy)
ACCEPT(4) Baker, Cole, Renaud, Williams
MODIFY(1) Frech
NOOP(2) Wall, Ziese
RECAST(1) Christey
Comments (Legacy) 
 Christey> CONFIRM:http://www.mozilla.org/projects/bugzilla/security2_12.html
 Frech> XF:bugzilla-email-shell-characters(6488)
 CHANGE> [Christey changed vote from NOOP to RECAST]
 Christey> This needs to be MERGED with CVE-2000-0421.
   CVE-2000-0421 documents a problem in the "who" parameter of
   the process_bug.cgi program.  This is a duplicate of one of the
   problems being identified by CVE-2001-0329.  The other problem 
   in CVE-2001-0329, the Bugzilla_login cookie, is fixed in
   the same version as the who problem is.  CD:SF-EXEC
   suggests merging multiple executables in the same package
   that have the same problem that is present in the same version.
   Both the "who" and "Bugzilla_login" problems were fixed in
   version 2.12.  Therefore CVE-2000-0421 and CVE-2001-0329
   need to be MERGED.
   
   CHANGEREF BID:1199
Proposed (Legacy)
20010524
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
  
You can also search by reference using the CVE Reference Maps.
For More Information:  CVE Request Web Form (select "Other" from dropdown)
Back to top