3.4.1, 3.2.4, and 3.0.8 Security Advisory
Friday, Sep 11th, 2009
Summary
=======
Bugzilla is a Web-based bug-tracking system used by a large number of
software projects. The following security issues have been discovered
in Bugzilla:
* Two SQL injection attacks have been discovered in Bugzilla. One
only affects the 3.4 series, while the other affects
the 3.0, 3.2, and 3.4 series. These are extremely serious
vulnerabilities that must be patched immediately.
* Two SQL injection attacks have been discovered in Bugzilla. One
only affects the 3.4 series, while the other affects
the 3.0, 3.2, and 3.4 series. These are extremely serious
vulnerabilities that must be patched immediately.
* When a user would change his password, his new password would
be exposed in the URL field of the browser if he logged in right
after changing his password.
All affected installations are encouraged to upgrade as soon as
possible.
Vulnerability Details
=====================
Class: SQL Injection
Affected: 3.3.2 to 3.4.1, 3.5
Fixed In: 3.4.2
Description: It is possible to inject raw SQL into the Bugzilla
database via the Bug.search WebService function. This
could be used to expose any data stored in the Bugzilla
database, including confidential bugs. It is also possible
that an attacker could modify or delete any data stored in
the Bugzilla database (though we haven't discovered a
working exploit that modifies or deletes data).
The danger of this exploit is slightly lessened by the
fact that Bugzilla's backend does not accept multiple
statements separated by a semicolon, so you cannot add
additional SQL statements (such as a DELETE or INSERT)
using the exploit. However, this is still an extremely
critical issue which administrators should patch
immediately.
References: https://bugzilla.mozilla.org/show_bug.cgi?id=515191
CVE Number: CVE-2009-3125
Class: SQL Injection
Affected: 2.23.4 to 3.0.8, 3.1.1 to 3.2.4, 3.3.1 to 3.4.1
Fixed In: 3.0.9, 3.2.5, 3.4.2
Description: It is possible to inject raw SQL into the Bugzilla
database via the Bug.create WebService function. This
could be used to expose any data stored in the Bugzilla
database, including confidential bugs. It is also possible
that an attacker could modify or delete any data stored in
the Bugzilla database (though we haven't discovered a
working exploit that modifies or deletes existing data).
The danger of this exploit is slightly lessened by the
fact that Bugzilla's backend does not accept multiple
statements separated by a semicolon, so you cannot add
additional SQL statements (such as a DELETE or UPDATE)
using the exploit.
This particular hole is much more difficult to exploit
than the Bug.search one, due to the fact that the SQL
around the insertion point is highly random, making it
difficult for an attacker to craft a successful attack.
However, even considering these factors, this is still an
extremely critical issue which administrators should patch
immediately.
References: https://bugzilla.mozilla.org/show_bug.cgi?id=515191
CVE Number: CVE-2009-3165
Class: Sensitive Data Exposure
Affected: 3.4rc1 to 3.4.1
Fixed In: 3.4.2
Description: When a user reset their password and then logged
in immediately afterward, their password would appear
in the URL of their browser, which also possibly means
that that password would appear in the Bugzilla
webserver's logs and in the Referer header of any page
whose link was clicked immediately after logging in
(although by default Bugzilla only links to itself, on
that page).
References: https://bugzilla.mozilla.org/show_bug.cgi?id=508189
CVE Number: CVE-2009-3166
Vulnerability Solutions
=======================
The fix for these issues is included in the
releases. Upgrading to a release with the relevant fix will
protect your installation from possible exploits of these issues.
If you are unable to upgrade but would like to patch just the security
vulnerability, there are patches available for the issues at the
"References" URL.
Full release downloads, patches to upgrade Bugzilla from previous
versions, and git upgrade instructions are available at:
https://www.bugzilla.org/download/
Credits
=======
The Bugzilla team wish to thank the following people for their
assistance in locating, advising us of, and assisting us to fix this
issue:
Issue 1 Reporter: Max Kanat-Alexander
Issue 1 Fixed by: Max Kanat-Alexander, Frédéric Buclin
Issue 2 Reporter: Max Kanat-Alexander
Issue 2 Fixed by: Max Kanat-Alexander, Frédéric Buclin
Issue 3 Reporter: Max Kanat-Alexander
Issue 3 Fixed by: Max Kanat-Alexander, Bradley Baetz, Frédéric Buclin
General information about the Bugzilla bug-tracking system can be found
at:
https://www.bugzilla.org/
Comments and follow-ups can be directed to the support-bugzilla mailing list.
https://www.bugzilla.org/support/ has directions for accessing this forum.
