3.2.7, 3.4.7, 3.6.1, and 3.7.2 Security Advisory
Thursday, Aug 5th, 2010
Summary
=======
Bugzilla is a Web-based bug-tracking system used by a large number of
software projects. The following security issues have been discovered
in Bugzilla:
* It was possible to (at least partially) determine the membership
of any group using the Search interface.
* It was possible to use the 'sudo' feature without sending
a notification to the user being impersonated.
* The 'Reports' and 'Duplicates' pages let you guess the name of
products you could not see, due to the error message that was
thrown.
* For installations using PostgreSQL, specifying "bug X" or
"attachment X" in a comment would deny access to the bug if X was
larger than the maximum 32-bit signed integer size.
All affected installations are encouraged to upgrade as soon as
possible.
Vulnerability Details
=====================
Class: Remote Information Disclosure
Affected: 2.19.1 to 3.2.7, 3.3.1 to 3.4.7, 3.5.1 to 3.6.1, 3.7 to 3.7.2
Fixed In: 3.2.8, 3.4.8, 3.6.2, 3.7.3
Description: An unprivileged user is normally not allowed to view
other users' group membership. But boolean charts
let the user use group-based pronouns, indirectly
disclosing group membership. This security fix
restricts the use of pronouns to groups the user
belongs to.
References: https://bugzilla.mozilla.org/show_bug.cgi?id=417048
CVE Number: CVE-2010-2756
Class: Notification Bypass
Affected: 2.22rc1 to 3.2.7, 3.3.1 to 3.4.7, 3.5.1 to 3.6.1, 3.7 to 3.7.2
Fixed In: 3.2.8, 3.4.8, 3.6.2, 3.7.3
Description: Normally, when a user is impersonated, he receives
an email informing him that he is being impersonated,
containing the identity of the impersonator. However,
it was possible to impersonate a user without this
notification being sent.
References: https://bugzilla.mozilla.org/show_bug.cgi?id=450013
CVE Number: CVE-2010-2757
Class: Remote Information Disclosure
Affected: 2.17.1 to 3.2.7, 3.3.1 to 3.4.7, 3.5.1 to 3.6.1, 3.7 to 3.7.2
Fixed In: 3.2.8, 3.4.8, 3.6.2, 3.7.3
Description: An error message thrown by the "Reports" and "Duplicates"
page confirmed the non-existence of products, thus
allowing users to guess confidential product names.
(Note that the "Duplicates" page was not vulnerable
in Bugzilla 3.6rc1 and above though.)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=577139
https://bugzilla.mozilla.org/show_bug.cgi?id=519835
CVE Number: CVE-2010-2758
Class: Denial of Service
Affected: 2.23.1 to 3.2.7, 3.3.1 to 3.4.7, 3.5.1 to 3.6.1, 3.7 to 3.7.2
Fixed In: 3.2.8, 3.4.8, 3.6.2, 3.7.3
Description: If a comment contained the phrases "bug X" or
"attachment X", where X was an integer larger than the
maximum 32-bit signed integer size, PostgreSQL would
throw an error, and any page containing that comment would
not be viewable. On most Bugzillas, any user can enter
a comment on any bug, so any user could have used this to
deny access to one or all bugs. Bugzillas running on
databases other than PostgreSQL are not affected.
References: https://bugzilla.mozilla.org/show_bug.cgi?id=583690
CVE Number: CVE-2010-2759
Vulnerability Solutions
=======================
The fix for these issues is included in the
releases. Upgrading to a release with the relevant fix will
protect your installation from possible exploits of these issues.
If you are unable to upgrade but would like to patch just the security
vulnerability, there are patches available for the issues at the
"References" URL.
Full release downloads, patches to upgrade Bugzilla from previous
versions, and git upgrade instructions are available at:
https://www.bugzilla.org/download/
Credits
=======
The Bugzilla team wish to thank the following people for their
assistance in locating, advising us of, and assisting us to fix this
issue:
Issue 1 Reporter: Frédéric Buclin
Issue 1 Fixed by: Frédéric Buclin
Issue 2 Reporter: Bradley Baetz
Issue 2 Fixed by: Frédéric Buclin, Byron Jones
Issue 3 Reporter: Frédéric Buclin
Issue 3 Fixed by: Max Kanat-Alexander, Frédéric Buclin
Issue 4 Reporter: Slava Buhtiarov
Issue 4 Fixed by: Frédéric Buclin
General information about the Bugzilla bug-tracking system can be found
at:
https://www.bugzilla.org/
Comments and follow-ups can be directed to the support-bugzilla mailing list.
https://www.bugzilla.org/support/ has directions for accessing this forum.
