This host is running Bugzilla and is prone to information disclosure vulnerability.

Successful exploitation will allow attackers to read sensitive configuration fields. Impact Level: Application

Upgrade to Bugzilla version 3.6.1, 3.7.1 or later, For updates refer to http://www.bugzilla.org/download/

The flaw is due to an error in 'install/Filesystem.pm', which uses world readable permissions for the localconfig files via the database password field and the site_wide_secret field.

Bugzilla version 3.5.1 to 3.6 and 3.7

• http://secunia.com/advisories/40300
• http://www.bugzilla.org/security/3.2.6/
• http://www.vupen.com/english/advisories/2010/1595
• https://bugzilla.mozilla.org/show_bug.cgi?id=561797

---

Updated on 2015-03-25