2.16.6, 2.18rc2, 2.19 Security Advisory
Sunday, Oct 24th, 2004
2.16.6, 2.18rc2, 2.19 Security Advisory
October 24, 2004
Summary
=======
Bugzilla is a Web-based bug-tracking system, used by a large number of
software projects.
This advisory covers three security bugs that have recently been
discovered and fixed in the Bugzilla code: In the stable 2.16 releases,
it is possible to make a specific change to a bug without permissions;
and in the 2.18 release candidate, there are information leaks with
private attachments and comments. We are not aware of any occasions where
any of these vulnerabilities have been exploited.
All Bugzilla installations are advised to upgrade to the latest stable
version of Bugzilla, 2.16.7, or to the current 2.18 release candidates,
2.18rc3, which were released today.
Development snapshots and version 2.18 release candidates prior to
version 2.18rc3 are also affected, so if you are using a development
snapshot or 2.18 release candidate, you should obtain a newer one
(2.18rc3) or use CVS to update.
Vulnerability Details
=====================
Issue 1
-------
Class: Unauthorized Bug Change
Versions: 2.9 through 2.18rc2 and 2.19
Description: It is possible to send a carefully crafted HTTP POST
message to process_bug.cgi which will remove keywords from
a bug even if you don't have permissions to edit all bug
fields (the "editbugs" permission). Such changes are
reported in "bug changed" email notifications, so they are
easily detected and reversed if someone abuses it.
Reference: https://bugzilla.mozilla.org/show_bug.cgi?id=252638
Issue 2
-------
Class: Information Leak
Versions: 2.17.1 through 2.18rc2 and 2.19 (2.16-based releases and
earlier are not affected)
Description: Exporting a bug to XML exposes user comments and attachment
summaries which are marked as private to users who are not
members of the group allowed to see private comments and
attachments. XML export is not exposed in the user
interface, but is available to anyone who knows the correct
URL to invoke it. This only affects sites that use the
'insidergroup' feature.
Reference: https://bugzilla.mozilla.org/show_bug.cgi?id=263780
Issue 3
-------
Class: Information Leak
Versions: 2.17.1 through 2.18rc2 and 2.19 (2.16-based releases and
earlier are not affected)
Description: Changes to the metadata (filename, description, mime type,
review flags) on attachments which were flagged as private
get displayed to users who are not members of the group
allowed to see private attachments when viewing the bug
activity log and when receiving bug change notification
mails. This only affects sites that use the 'insidergroup'
feature.
References: https://bugzilla.mozilla.org/show_bug.cgi?id=250605
https://bugzilla.mozilla.org/show_bug.cgi?id=253544
Vulnerability Solutions
=======================
The fixes for all of the security bugs mentioned in this advisory are
included in the 2.16.7 and 2.18rc3 releases, and in the 2.19.1
development snapshot. Upgrading to these releases will protect
installations from possible exploits of these issues.
Full release downloads, patches to upgrade Bugzilla to 2.16.7 from
previous 2.16.x versions, and CVS upgrade instructions are available at:
https://www.bugzilla.org/download/
Specific patches for each of the individual issues can be found on the
corresponding bug reports for each issue, at the URL given in the
reference for that issue in the list above.
Credits
=======
The Bugzilla team wish to thank the following people for their
assistance in locating, advising us of, and assisting us to fix
these situations:
Michael Whitfield
Joel Peshkin
Casey Klein
Myk Melez
General information about the Bugzilla bug-tracking system can be found
at https://www.bugzilla.org/
Comments and follow-ups can be directed to the
netscape.public.mozilla.webtools newsgroup or the mozilla-webtools
mailing list; https://www.bugzilla.org/support/ has directions for
accessing these forums.
-30-
