[BUGZILLA] Vulnerabilities in Bugzilla 2.16.6 and 2.18rc2

From: David Miller (justdave_at_bugzilla.org)
Date: 10/25/04

  • Next message: Thor: "Re: Is Windows up to snuff for running our world?" 
    Date: Mon, 25 Oct 2004 07:08:47 -0400
To: announce@bugzilla.org, Mozilla-Webtools <mozilla-webtools@mozilla.org>, announce@mozilla.org, bugtraq@securityfocus.com

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    Bugzilla Security Advisory
    October 24, 2004

    Summary
    =======

    Bugzilla is a Web-based bug-tracking system, used by a large number of
    software projects.

    This advisory covers three security bugs that have recently been
    discovered and fixed in the Bugzilla code: In the stable 2.16 releases,
    it is possible to make a specific change to a bug without permissions;
    and in the 2.18 release candidate, there are information leaks with
    private attachments and comments. We are not aware of any occasions
    where any of these vulnerabilities have been exploited.

    All Bugzilla installations are advised to upgrade to the latest stable
    version of Bugzilla, 2.16.7, or to the current 2.18 release candidates,
    2.18rc3, which were released today.

    Development snapshots and version 2.18 release candidates prior to
    version 2.18rc3 are also affected, so if you are using a development
    snapshot or 2.18 release candidate, you should obtain a newer one
    (2.18rc3) or use CVS to update.

    Vulnerability Details
    =====================

    Issue 1
    - -------
    Class: Unauthorized Bug Change
    Versions: 2.9 through 2.18rc2 and 2.19(from cvs)
    Description: It is possible to send a carefully crafted HTTP POST
    ~ message to process_bug.cgi which will remove keywords from
    ~ a bug even if you don't have permissions to edit all bug
    ~ fields (the "editbugs" permission). Such changes are
    ~ reported in "bug changed" email notifications, so they are
    ~ easily detected and reversed if someone abuses it.
    Reference: https://bugzilla.mozilla.org/show_bug.cgi?id=252638

    Issue 2
    - -------
    Class: Information Leak
    Versions: 2.17.1 through 2.18rc2 and 2.19(from cvs) (2.16-based
    ~ releases and earlier are not affected)
    Description: Exporting a bug to XML exposes user comments and attachment
    ~ summaries which are marked as private to users who are not
    ~ members of the group allowed to see private comments and
    ~ attachments. XML export is not exposed in the user
    ~ interface, but is available to anyone who knows the correct
    ~ URL to invoke it. This only affects sites that use the
    ~ 'insidergroup' feature.
    Reference: https://bugzilla.mozilla.org/show_bug.cgi?id=263780

    Issue 3
    - -------
    Class: Information Leak
    Versions: 2.17.1 through 2.18rc2 and 2.19(from cvs) (2.16-based
    ~ releases and earlier are not affected)
    Description: Changes to the metadata (filename, description, mime type,
    ~ review flags) on attachments which were flagged as private
    ~ get displayed to users who are not members of the group
    ~ allowed to see private attachments when viewing the bug
    ~ activity log and when receiving bug change notification
    ~ mails. This only affects sites that use the 'insidergroup'
    ~ feature.
    References: https://bugzilla.mozilla.org/show_bug.cgi?id=250605
    ~ https://bugzilla.mozilla.org/show_bug.cgi?id=253544

    Vulnerability Solutions
    =======================

    The fixes for all of the security bugs mentioned in this advisory are
    included in the 2.16.7 and 2.18rc3 releases, and in the 2.19.1
    development snapshot. Upgrading to these releases will protect
    installations from possible exploits of these issues.

    Full release downloads, patches to upgrade Bugzilla to 2.16.7 from
    previous 2.16.x versions, and CVS upgrade instructions are available at:
    ~ http://www.bugzilla.org/download/

    Specific patches for each of the individual issues can be found on the
    corresponding bug reports for each issue, at the URL given in the
    reference for that issue in the list above.

    Credits
    =======

    The Bugzilla team wish to thank the following people for their
    assistance in locating, advising us of, and assisting us to fix
    these situations:

    Michael Whitfield
    Joel Peshkin
    Casey Klein
    Myk Melez

    General information about the Bugzilla bug-tracking system can be found
    at http://www.bugzilla.org/

    Comments and follow-ups can be directed to the
    netscape.public.mozilla.webtools newsgroup or the mozilla-webtools
    mailing list; http://www.bugzilla.org/support/ has directions for
    accessing these forums.

    - -30-

    - --
    Dave Miller Project Leader, Bugzilla Bug Tracking System
    http://www.justdave.net/ http://www.bugzilla.org/

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.2 (Darwin)
    Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

    iD8DBQFBfN6/0YeDAOcbS44RAvirAJ99cbiFQj9uuF3XjZWRHqQMZDlebgCghu7D
    htGWOrR2hzC2mh52Z2iXjwU=
    =IYxd
    -----END PGP SIGNATURE-----

  • Next message: Thor: "Re: Is Windows up to snuff for running our world?"

    Relevant Pages