[go: up one dir, main page]

3.2.7, 3.4.7, 3.6.1, and 3.7.2 Security Advisory

Thursday, Aug 5th, 2010
Summary
=======

Bugzilla is a Web-based bug-tracking system used by a large number of
software projects. The following security issues have been discovered
in Bugzilla:

* It was possible to (at least partially) determine the membership
  of any group using the Search interface.

* It was possible to use the 'sudo' feature without sending
  a notification to the user being impersonated.

* The 'Reports' and 'Duplicates' pages let you guess the name of
  products you could not see, due to the error message that was
  thrown.

* For installations using PostgreSQL, specifying "bug X" or
  "attachment X" in a comment would deny access to the bug if X was
  larger than the maximum 32-bit signed integer size.

All affected installations are encouraged to upgrade as soon as
possible.


Vulnerability Details
=====================

Class:       Remote Information Disclosure
Affected:    2.19.1 to 3.2.7, 3.3.1 to 3.4.7, 3.5.1 to 3.6.1, 3.7 to 3.7.2
Fixed In:    3.2.8, 3.4.8, 3.6.2, 3.7.3
Description: An unprivileged user is normally not allowed to view
             other users' group membership. But boolean charts
             let the user use group-based pronouns, indirectly
             disclosing group membership. This security fix
             restricts the use of pronouns to groups the user
             belongs to.
References:  https://bugzilla.mozilla.org/show_bug.cgi?id=417048
CVE Number:  CVE-2010-2756


Class:       Notification Bypass
Affected:    2.22rc1 to 3.2.7, 3.3.1 to 3.4.7, 3.5.1 to 3.6.1, 3.7 to 3.7.2
Fixed In:    3.2.8, 3.4.8, 3.6.2, 3.7.3
Description: Normally, when a user is impersonated, he receives
             an email informing him that he is being impersonated,
             containing the identity of the impersonator. However,
             it was possible to impersonate a user without this
             notification being sent.
References:  https://bugzilla.mozilla.org/show_bug.cgi?id=450013
CVE Number:  CVE-2010-2757


Class:       Remote Information Disclosure
Affected:    2.17.1 to 3.2.7, 3.3.1 to 3.4.7, 3.5.1 to 3.6.1, 3.7 to 3.7.2
Fixed In:    3.2.8, 3.4.8, 3.6.2, 3.7.3
Description: An error message thrown by the "Reports" and "Duplicates"
             page confirmed the non-existence of products, thus
             allowing users to guess confidential product names.
             (Note that the "Duplicates" page was not vulnerable
             in Bugzilla 3.6rc1 and above though.)
References:  https://bugzilla.mozilla.org/show_bug.cgi?id=577139
             https://bugzilla.mozilla.org/show_bug.cgi?id=519835
CVE Number:  CVE-2010-2758


Class:       Denial of Service
Affected:    2.23.1 to 3.2.7, 3.3.1 to 3.4.7, 3.5.1 to 3.6.1, 3.7 to 3.7.2
Fixed In:    3.2.8, 3.4.8, 3.6.2, 3.7.3
Description: If a comment contained the phrases "bug X" or
             "attachment X", where X was an integer larger than the
             maximum 32-bit signed integer size, PostgreSQL would
             throw an error, and any page containing that comment would
             not be viewable. On most Bugzillas, any user can enter
             a comment on any bug, so any user could have used this to
             deny access to one or all bugs. Bugzillas running on
             databases other than PostgreSQL are not affected.
References:  https://bugzilla.mozilla.org/show_bug.cgi?id=583690
CVE Number:  CVE-2010-2759


Vulnerability Solutions
=======================

The fix for these issues is included in the 
releases. Upgrading to a release with the relevant fix will
protect your installation from possible exploits of these issues.

If you are unable to upgrade but would like to patch just the security
vulnerability, there are patches available for the issues at the
"References" URL.

Full release downloads, patches to upgrade Bugzilla from previous
versions, and git upgrade instructions are available at:

  https://www.bugzilla.org/download/


Credits
=======

The Bugzilla team wish to thank the following people for their
assistance in locating, advising us of, and assisting us to fix this
issue:


Issue 1 Reporter: Frédéric Buclin
Issue 1 Fixed by: Frédéric Buclin


Issue 2 Reporter: Bradley Baetz
Issue 2 Fixed by: Frédéric Buclin, Byron Jones


Issue 3 Reporter: Frédéric Buclin
Issue 3 Fixed by: Max Kanat-Alexander, Frédéric Buclin


Issue 4 Reporter: Slava Buhtiarov
Issue 4 Fixed by: Frédéric Buclin

General information about the Bugzilla bug-tracking system can be found
at:

  https://www.bugzilla.org/

Comments and follow-ups can be directed to the support-bugzilla mailing list.
https://www.bugzilla.org/support/ has directions for accessing this forum.