ID

VAR-201108-0186

CVE

CVE-2011-2379

TITLE

Bugzilla Vulnerable to cross-site scripting

DESCRIPTION

Cross-site scripting (XSS) vulnerability in Bugzilla 2.4 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3, when Internet Explorer before 9 or Safari before 5.0.6 is used for Raw Unified mode, allows remote attackers to inject arbitrary web script or HTML via a crafted patch, related to content sniffing. Bugzilla is prone to the following vulnerabilities: 1. A security-bypass vulnerability. 2. An email header-injection vulnerability. 3. Multiple information-disclosure vulnerabilities. 4. Multiple cross-site scripting vulnerabilities. Successfully exploiting these issues may allow an attacker to bypass certain security restrictions, obtain sensitive information, execute arbitrary script code in the browser of an unsuspecting user, steal cookie-based authentication credentials, and perform actions in the vulnerable application in the context of the victim. Bugzilla is an open source defect tracking system developed by the Mozilla Foundation in the United States. It can manage the entire life cycle of defects in software development, such as submitting (new), repairing (resolve), and closing (close). Bugzilla 2.4 to 2.22.7, 3.0.x to 3.3.x, 3.4.x prior to 3.4.12, 3.5.x, 3.6.x prior to 3.6.6, 3.7.x, 4.0 prior to 4.0.2. x version, and 4.1.x versions prior to 4.1.3 have a cross-site scripting vulnerability. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2322-1 security@debian.org http://www.debian.org/security/ Jonathan Wiltshire October 10, 2011 http://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : bugzilla Vulnerability : several Problem type : remote Debian-specific: no CVE ID : CVE-201-2979 CVE-2010-4567 CVE-2010-4568 CVE-2010-4572 CVE-2011-0046 CVE-2011-0048 CVE-2011-2379 CVE-2011-2380 CVE-2011-2381 CVE-2011-2978 Several vulnerabilities were discovered in Bugzilla, a web-based bug tracking system. CVE-2010-4572 By inserting particular strings into certain URLs, it was possible to inject both headers and content to any browser. CVE-2010-4567, CVE-2011-0048 Bugzilla has a "URL" field that can contain several types of URL, including "javascript:" and "data:" URLs. However, it does not make "javascript:" and "data:" URLs into clickable links, to protect against cross-site scripting attacks or other attacks. It was possible to bypass this protection by adding spaces into the URL in places that Bugzilla did not expect them. Also, "javascript:" and "data:" links were *always* shown as clickable to logged-out users. CVE-2010-4568 It was possible for a user to gain unauthorized access to any Bugzilla account in a very short amount of time (short enough that the attack is highly effective). CVE-2011-0046 Various pages were vulnerable to Cross-Site Request Forgery attacks. CVE-2011-2978 When a user changes his email address, Bugzilla trusts a user-modifiable field for obtaining the current e-mail address to send a confirmation message to. If an attacker has access to the session of another user (for example, if that user left their browser window open in a public place), the attacker could alter this field to cause the email-change notification to go to their own address. This means that the user would not be notified that his account had its email address changed by the attacker. CVE-2011-2381 For flagmails only, attachment descriptions with a newline in them could lead to the injection of crafted headers in email notifications when an attachment flag is edited. CVE-2011-2379 Bugzilla uses an alternate host for attachments when viewing them in raw format to prevent cross-site scripting attacks. CVE-2011-2380 CVE-201-2979 Normally, a group name is confidential and is only visible to members of the group, and to non-members if the group is used in bugs. By crafting the URL when creating or editing a bug, it was possible to guess if a group existed or not, even for groups which weren't used in bugs and so which were supposed to remain confidential. For the oldstable distribution (lenny), it has not been practical to backport patches to fix these bugs. Users of bugzilla on lenny are strongly advised to upgrade to the version in the squeeze distribution. For the stable distribution (squeeze), these problems have been fixed in version 3.6.2.0-4.4. For the testing distribution (wheezy) and the unstable distribution (sid), the bugzilla packages have been removed. We recommend that you upgrade your bugzilla packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iEYEARECAAYFAk6TGQMACgkQXm3vHE4uylrKoACgpP8nXm2Nj6cmEPNLL5n4VVqQ cMsAoNuj8KxXmA437xUP1NZqnJrbWwFD =kZIo -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . ---------------------------------------------------------------------- The Secunia CSI 5.0 Beta - now available for testing Find out more, take a free test drive, and share your opinion with us: http://secunia.com/blog/242 ---------------------------------------------------------------------- TITLE: Bugzilla Multiple Vulnerabilities SECUNIA ADVISORY ID: SA45501 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/45501/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=45501 RELEASE DATE: 2011-08-05 DISCUSS ADVISORY: http://secunia.com/advisories/45501/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/45501/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=45501 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Multiple vulnerabilities have been reported in Bugzilla, which can be exploited by malicious, local users to gain access to potentially sensitive information and by malicious users to disclose potentially sensitive information, conduct script insertion and spoofing attacks. 1) Input passed via patch attachments is not properly sanitised before being viewed in "Raw Unified" mode. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed. Successful exploitation of this vulnerability requires the victim to use Internet Explorer or Safari browsers. SOLUTION: Update to version 3.4.12, 3.6.6, or 4.1.3 (please see the vendor's advisory for details). PROVIDED AND/OR DISCOVERED BY: The vendor provides a bundled list of credits: Fr\xe9d\xe9ric Buclin Byron Jones Max Kanat-Alexander Reed Loden Neal Poole Neil Rashbrook David Lawrence ORIGINAL ADVISORY: http://www.bugzilla.org/security/3.4.11/ OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . Background ========== Bugzilla is the bug-tracking system from the Mozilla project. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-apps/bugzilla < 3.6.6 >= 3.6.6 Description =========== Multiple vulnerabilities have been discovered in Bugzilla. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker could conduct cross-site scripting attacks, conduct script insertion and spoofing attacks, hijack the authentication of arbitrary users, inject arbitrary HTTP headers, obtain access to arbitrary accounts, disclose the existence of confidential groups and its names, or inject arbitrary e-mail headers. A local attacker could disclose the contents of temporarfy files for uploaded attachments. Workaround ========== There is no known workaround at this time. Resolution ========== All Bugzilla users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=www-apps/bugzilla-3.6.6" NOTE: This is a legacy GLSA. Updates for all affected architectures are available since August 27, 2011. It is likely that your system is already no longer affected by this issue. References ========== [ 1 ] CVE-2010-2761 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2761 [ 2 ] CVE-2010-3172 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3172 [ 3 ] CVE-2010-3764 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3764 [ 4 ] CVE-2010-4411 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4411 [ 5 ] CVE-2010-4567 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4567 [ 6 ] CVE-2010-4568 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4568 [ 7 ] CVE-2010-4569 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4569 [ 8 ] CVE-2010-4570 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4570 [ 9 ] CVE-2010-4572 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4572 [ 10 ] CVE-2011-0046 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0046 [ 11 ] CVE-2011-0048 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0048 [ 12 ] CVE-2011-2379 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2379 [ 13 ] CVE-2011-2380 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2380 [ 14 ] CVE-2011-2381 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2381 [ 15 ] CVE-2011-2976 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2976 [ 16 ] CVE-2011-2977 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2977 [ 17 ] CVE-2011-2978 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2978 [ 18 ] CVE-2011-2979 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2979 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-21f5d5f72.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2011 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

XSS

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Fr&amp;amp;amp;eacute;d&amp;amp;amp;eacute;ric Buclin, Byron Jones, Max Kanat-Alexander, Reed Loden, Neal Poole, Neil Rashbrook, David Lawrence

SOURCES

LAST UPDATE DATE

2024-11-23T19:56:23.580000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE