[BUGZILLA] Vulnerabilities in Bugzilla 2.16.6 and 2.18rc2

[David Miller]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Bugzilla Security Advisory
October 24, 2004

Summary
=======

Bugzilla is a Web-based bug-tracking system, used by a large number of
software projects.

This advisory covers three security bugs that have recently been
discovered and fixed in the Bugzilla code: In the stable 2.16 releases,
it is possible to make a specific change to a bug without permissions;
and in the 2.18 release candidate, there are information leaks with
private attachments and comments.  We are not aware of any occasions
where any of these vulnerabilities have been exploited.

All Bugzilla installations are advised to upgrade to the latest stable
version of Bugzilla, 2.16.7, or to the current 2.18 release candidates,
2.18rc3, which were released today.

Development snapshots and version 2.18 release candidates prior to
version 2.18rc3 are also affected, so if you are using a development
snapshot or 2.18 release candidate, you should obtain a newer one
(2.18rc3) or use CVS to update.


Vulnerability Details
=====================

Issue 1
- -------
Class:       Unauthorized Bug Change
Versions:    2.9 through 2.18rc2 and 2.19(from cvs)
Description: It is possible to send a carefully crafted HTTP POST
~             message to process_bug.cgi which will remove keywords from
~             a bug even if you don't have permissions to edit all bug
~             fields (the "editbugs" permission).  Such changes are
~             reported in "bug changed" email notifications, so they are
~             easily detected and reversed if someone abuses it.
Reference:   https://bugzilla.mozilla.org/show_bug.cgi?id=252638

Issue 2
- -------
Class:       Information Leak
Versions:    2.17.1 through 2.18rc2 and 2.19(from cvs) (2.16-based
~             releases and earlier are not affected)
Description: Exporting a bug to XML exposes user comments and attachment
~             summaries which are marked as private to users who are not
~             members of the group allowed to see private comments and
~             attachments.  XML export is not exposed in the user
~             interface, but is available to anyone who knows the correct
~             URL to invoke it.  This only affects sites that use the
~             'insidergroup' feature.
Reference:   https://bugzilla.mozilla.org/show_bug.cgi?id=263780

Issue 3
- -------
Class:       Information Leak
Versions:    2.17.1 through 2.18rc2 and 2.19(from cvs) (2.16-based
~             releases and earlier are not affected)
Description: Changes to the metadata (filename, description, mime type,
~             review flags) on attachments which were flagged as private
~             get displayed to users who are not members of the group
~             allowed to see private attachments when viewing the bug
~             activity log and when receiving bug change notification
~             mails.  This only affects sites that use the 'insidergroup'
~             feature.
References:  https://bugzilla.mozilla.org/show_bug.cgi?id=250605
~             https://bugzilla.mozilla.org/show_bug.cgi?id=253544


Vulnerability Solutions
=======================

The fixes for all of the security bugs mentioned in this advisory are
included in the 2.16.7 and 2.18rc3 releases, and in the 2.19.1
development snapshot.  Upgrading to these releases will protect
installations from possible exploits of these issues.

Full release downloads, patches to upgrade Bugzilla to 2.16.7 from
previous 2.16.x versions, and CVS upgrade instructions are available at:
~  http://www.bugzilla.org/download/

Specific patches for each of the individual issues can be found on the
corresponding bug reports for each issue, at the URL given in the
reference for that issue in the list above.


Credits
=======

The Bugzilla team wish to thank the following people for their
assistance in locating, advising us of, and assisting us to fix
these situations:

Michael Whitfield
Joel Peshkin
Casey Klein
Myk Melez


General information about the Bugzilla bug-tracking system can be found
at http://www.bugzilla.org/

Comments and follow-ups can be directed to the
netscape.public.mozilla.webtools newsgroup or the mozilla-webtools
mailing list; http://www.bugzilla.org/support/ has directions for
accessing these forums.

- -30-

- --
Dave Miller      Project Leader, Bugzilla Bug Tracking System
http://www.justdave.net/             http://www.bugzilla.org/









-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (Darwin)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBfN6/0YeDAOcbS44RAvirAJ99cbiFQj9uuF3XjZWRHqQMZDlebgCghu7D
htGWOrR2hzC2mh52Z2iXjwU=
=IYxd
-----END PGP SIGNATURE-----