2.16.6, 2.18rc2, 2.19 Security Advisory

Sunday, Oct 24th, 2004

2.16.6, 2.18rc2, 2.19 Security Advisory

October 24, 2004

Bugzilla is a Web-based bug-tracking system, used by a large number of
software projects.

This advisory covers three security bugs that have recently been
discovered and fixed in the Bugzilla code: In the stable 2.16 releases,
it is possible to make a specific change to a bug without permissions;
and in the 2.18 release candidate, there are information leaks with
private attachments and comments.  We are not aware of any occasions where
any of these vulnerabilities have been exploited.

All Bugzilla installations are advised to upgrade to the latest stable
version of Bugzilla, 2.16.7, or to the current 2.18 release candidates,
2.18rc3, which were released today.

Development snapshots and version 2.18 release candidates prior to
version 2.18rc3 are also affected, so if you are using a development
snapshot or 2.18 release candidate, you should obtain a newer one
(2.18rc3) or use CVS to update.

Vulnerability Details

Issue 1
Class:       Unauthorized Bug Change
Versions:    2.9 through 2.18rc2 and 2.19
Description: It is possible to send a carefully crafted HTTP POST
             message to process_bug.cgi which will remove keywords from
             a bug even if you don't have permissions to edit all bug
             fields (the "editbugs" permission).  Such changes are
             reported in "bug changed" email notifications, so they are
             easily detected and reversed if someone abuses it.
Reference:   https://bugzilla.mozilla.org/show_bug.cgi?id=252638

Issue 2
Class:       Information Leak
Versions:    2.17.1 through 2.18rc2 and 2.19 (2.16-based releases and
             earlier are not affected)
Description: Exporting a bug to XML exposes user comments and attachment
             summaries which are marked as private to users who are not
             members of the group allowed to see private comments and
             attachments.  XML export is not exposed in the user
             interface, but is available to anyone who knows the correct
             URL to invoke it.  This only affects sites that use the
             'insidergroup' feature.
Reference:   https://bugzilla.mozilla.org/show_bug.cgi?id=263780

Issue 3
Class:       Information Leak
Versions:    2.17.1 through 2.18rc2 and 2.19 (2.16-based releases and
             earlier are not affected)
Description: Changes to the metadata (filename, description, mime type,
             review flags) on attachments which were flagged as private
             get displayed to users who are not members of the group
             allowed to see private attachments when viewing the bug
             activity log and when receiving bug change notification
             mails.  This only affects sites that use the 'insidergroup'
References:  https://bugzilla.mozilla.org/show_bug.cgi?id=250605

Vulnerability Solutions

The fixes for all of the security bugs mentioned in this advisory are
included in the 2.16.7 and 2.18rc3 releases, and in the 2.19.1
development snapshot.  Upgrading to these releases will protect
installations from possible exploits of these issues.

Full release downloads, patches to upgrade Bugzilla to 2.16.7 from
previous 2.16.x versions, and CVS upgrade instructions are available at:

Specific patches for each of the individual issues can be found on the
corresponding bug reports for each issue, at the URL given in the
reference for that issue in the list above.


The Bugzilla team wish to thank the following people for their
assistance in locating, advising us of, and assisting us to fix
these situations:

Michael Whitfield
Joel Peshkin
Casey Klein
Myk Melez

General information about the Bugzilla bug-tracking system can be found
at https://www.bugzilla.org/

Comments and follow-ups can be directed to the
netscape.public.mozilla.webtools newsgroup or the mozilla-webtools
mailing list; https://www.bugzilla.org/support/ has directions for
accessing these forums.