Security advisory for Bugzilla < 2.16.11

David Miller justdave at
Wed Dec 28 05:52:23 UTC 2005

Hash: SHA1

Bugzilla Security Advisory

December 27, 2005


Bugzilla is a Web-based bug-tracking system, used by a large number of
software projects.

This advisory covers an insecure temporary filename handling issue in
versions of Bugzilla prior to 2.16.11 which make use of the shadow
database feature.  Versions 2.18 and newer are not affected, nor are
older installations which do not use the shadow database.

Vulnerability Details

Class:       Insecure temporary filename handling
Impact:      Privilege escalation
Where:       Local system
Versions:    2.9 through 2.16.10.  Newer versions are not
Description: Bugzilla uses a script called syncshadowdb to manually
             replicate data between a master database and a slave.
             The script uses temporary files in an unsafe way since it
             selects a name for the file based on PID and does not make
             any effort to determine if the file exists and if it is a
             symlink. A local user could use this to direct symlink
             attacks and overwrite files that Bugzilla has access to.
CVE Name:    CVE-2005-4534

Vulnerability Solutions

The fix for this security issue will be included in the upcoming 2.16.11
release of Bugzilla.  In the meantime, the patch to fix this issue can
be obtained from the URL listed in the reference above.  The patch only
touches the syncshadowdb file.

Please note that Bugzilla version 2.16.* is an older release and very
near end-of-life of its security support.  Users are advised to upgrade
to the latest stable release as soon as possible to continue to receive
security support.


The Bugzilla team wish to thank the following people for their
assistance in locating, advising us of, and assisting us to fix
these situations:

Javier Fernández-Sanguino Peña
Teemu Mannermaa

General information about the Bugzilla bug-tracking system can be found

Comments and follow-ups can be directed to the
netscape.public.mozilla.webtools newsgroup or the mozilla-webtools
mailing list; has directions for
accessing these forums.


- --
Dave Miller                         
System Administrator, Mozilla Corporation
Project Leader, Bugzilla Bug Tracking System

Version: GnuPG v1.4.1 (Darwin)
Comment: Using GnuPG with Mozilla -


More information about the announce mailing list