NVD

Id
47818  
Name
CVE-2009-0486  
Description
Bugzilla 3.2.1, 3.0.7, and 3.3.2, when running under mod_perl, calls the srand function at startup time, which causes Apache children to have the same seed and produce insufficiently random numbers for random tokens, which allows remote attackers to bypass cross-site request forgery (CSRF) protection mechanisms and conduct unauthorized activities as other users.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2009-02-09  
Modified Date
2009-03-25  
Seq
2009-0486  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
239540 47818 CVE-2009-0486 http://www.bugzilla.org/security/3.0.7/  View
239541 47818 CVE-2009-0486 33581  View
239542 47818 CVE-2009-0486 FEDORA-2009-2418  View
239543 47818 CVE-2009-0486 FEDORA-2009-2417  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
40418 JVNDB-2009-001424 Bugzilla におけるランダムなトークンの生成に関する脆弱性 mod_perl 下で動作している Bugzilla には、起動時に srand 関数が呼び出される場合、 CVE-2009-0486 37917 CVE-2009-0486 47818 7.5 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001424.html 2009-02-09 2009-06-30 View