[ANN] Security Advisory for Bugzilla 3.4.1, 3.2.4, and 3.0.8

[Max Kanat-Alexander]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Summary
=======

Bugzilla is a Web-based bug-tracking system, used by a large number of
software projects.

* Two SQL injection attacks have been discovered in Bugzilla. One
  only affects the 3.4 series, while the other affects
  the 3.0, 3.2, and 3.4 series. These are extremely serious
  vulnerabilities that must be patched immediately.

* When a user would change his password, his new password would
  be exposed in the URL field of the browser if he logged in right
  after changing his password.

All affected installations are encouraged to upgrade immediately.


Vulnerability Details
=====================

Class:       SQL Injection
Versions:    3.3.2 to 3.4.1, 3.5
Fixed In:    3.4.2
Description: It is possible to inject raw SQL into the Bugzilla
             database via the Bug.search WebService function. This
             could be used to expose any data stored in the Bugzilla
             database, including confidential bugs. It is also possible
             that an attacker could modify or delete any data stored in
             the Bugzilla database (though we haven't discovered a
             working exploit that modifies or deletes data).

             The danger of this exploit is slightly lessened by the
             fact that Bugzilla's backend does not accept multiple
             statements separated by a semicolon, so you cannot add
             additional SQL statements (such as a DELETE or INSERT)
             using the exploit. However, this is still an extremely
             critical issue which administrators should patch
             immediately.

References:  https://bugzilla.mozilla.org/show_bug.cgi?id=515191
CVE Number:  CVE-2009-3125

Class:       SQL Injection
Versions:    2.23.4 to 3.0.8, 3.1.1 to 3.2.4, 3.3.1 to 3.4.1
Fixed In:    3.0.9, 3.2.5, 3.4.2
Description: It is possible to inject raw SQL into the Bugzilla
             database via the Bug.create WebService function. This
             could be used to expose any data stored in the Bugzilla
             database, including confidential bugs. It is also possible
             that an attacker could modify or delete any data stored in
             the Bugzilla database (though we haven't discovered a
             working exploit that modifies or deletes existing data).

             The danger of this exploit is slightly lessened by the
             fact that Bugzilla's backend does not accept multiple
             statements separated by a semicolon, so you cannot add
             additional SQL statements (such as a DELETE or UPDATE)
             using the exploit.

             This particular hole is much more difficult to exploit
             than the Bug.search one, due to the fact that the SQL
             around the insertion point is highly random, making it
             difficult for an attacker to craft a successful attack.

             However, even considering these factors, this is still an
             extremely critical issue which administrators should patch
             immediately.

References:  https://bugzilla.mozilla.org/show_bug.cgi?id=515191
CVE Number:  CVE-2009-3165

Class:       Sensitive Data Exposure
Versions:    3.4rc1 to 3.4.1
Fixed In:    3.4.2
Description: When a user reset their password and then logged
             in immediately afterward, their password would appear
             in the URL of their browser, which also possibly means
             that that password would appear in the Bugzilla
             webserver's logs and in the Referer header of any page
             whose link was clicked immediately after logging in
             (although by default Bugzilla only links to itself, on
             that page).

References:  https://bugzilla.mozilla.org/show_bug.cgi?id=508189
CVE Number:  CVE-2009-3166


Vulnerability Solutions
=======================

The fixes for these issues are included in the 3.4.2, 3.2.5, and 3.0.9
releases. Upgrading to a release with the relevant fixes will protect
your installation from possible exploits of these issues.

If you are unable to upgrade but would like to patch just the
individual security vulnerabilities, there are patches available for
the individual issues in the Reference URLs of each advisory.

Note that if you are running the (unreleased) 3.5 series, it is also
affected by all these vulnerabilities and you should update from CVS to
get the fixes.

Full release downloads, patches to upgrade Bugzilla from previous
versions, and CVS upgrade instructions are available at:

  http://www.bugzilla.org/download/


Credits
=======

The Bugzilla team wish to thank the following people/organizations for
their assistance in locating, advising us of, and assisting us to fix
these issues:

Max Kanat-Alexander
Bradley Baetz
Frédéric Buclin

General information about the Bugzilla bug-tracking system can be found
at:

  http://www.bugzilla.org/

Comments and follow-ups can be directed to the mozilla.support.bugzilla
newsgroup or the support-bugzilla mailing list.
http://www.bugzilla.org/support/ has directions for accessing these
forums.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkqqjiQACgkQaL2D/aEJPK4D8QCgxuabVKEUH/3p0L5vA8EKJrFt
f7kAoJFN7ctlpMUSAX0D34GPcQBr11FA
=zYbL
-----END PGP SIGNATURE-----