[ANN] Security Advisory for Bugzilla 3.2.7, 3.4.7, 3.6.1, and 3.7.2

[Max Kanat-Alexander]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Summary
=======

Bugzilla is a Web-based bug-tracking system used by a large number of
software projects. The following security issues have been discovered
in Bugzilla:

* It was possible to (at least partially) determine the membership
  of any group using the Search interface.

* It was possible to use the 'sudo' feature without sending
  a notification to the user being impersonated.

* The 'Reports' and 'Duplicates' pages let you guess the name of
  products you could not see, due to the error message that was
  thrown.

* For installations using PostgreSQL, specifying "bug X" or
  "attachment X" in a comment would deny access to the bug if X was
  larger than the maximum 32-bit signed integer size.

All affected installations are encouraged to upgrade as soon as
possible.

Vulnerability Details
=====================

Class:       Remote Information Disclosure
Versions:    2.19.1 to 3.2.7, 3.3.1 to 3.4.7, 3.5.1 to 3.6.1,
             3.7 to 3.7.2
Fixed In:    3.2.8, 3.4.8, 3.6.2, 3.7.3
Description: An unprivileged user is normally not allowed to view
             other users' group membership. But boolean charts
             let the user use group-based pronouns, indirectly
             disclosing group membership. This security fix
             restricts the use of pronouns to groups the user
             belongs to.
References:  https://bugzilla.mozilla.org/show_bug.cgi?id=417048
CVE Number:  CVE-2010-2756

Class:       Notification Bypass
Versions:    2.22rc1 to 3.2.7, 3.3.1 to 3.4.7, 3.5.1 to 3.6.1,
             3.7 to 3.7.2
Fixed In:    3.2.8, 3.4.8, 3.6.2, 3.7.3
Description: Normally, when a user is impersonated, he receives
             an email informing him that he is being impersonated,
             containing the identity of the impersonator. However,
             it was possible to impersonate a user without this
             notification being sent.
References:  https://bugzilla.mozilla.org/show_bug.cgi?id=450013
CVE Number:  CVE-2010-2757

Class:       Remote Information Disclosure
Versions:    2.17.1 to 3.2.7, 3.3.1 to 3.4.7, 3.5.1 to 3.6.1,
             3.7 to 3.7.2
Fixed In:    3.2.8, 3.4.8, 3.6.2, 3.7.3
Description: An error message thrown by the "Reports" and "Duplicates"
             page confirmed the non-existence of products, thus
             allowing users to guess confidential product names.
             (Note that the "Duplicates" page was not vulnerable
             in Bugzilla 3.6rc1 and above though.)
References:  https://bugzilla.mozilla.org/show_bug.cgi?id=577139
             https://bugzilla.mozilla.org/show_bug.cgi?id=519835
CVE Number:  CVE-2010-2758

Class:       Denial of Service
Versions:    2.23.1 to 3.2.7, 3.3.1 to 3.4.7, 3.5.1 to 3.6.1,
             3.7 to 3.7.2
Fixed In:    3.2.8, 3.4.8, 3.6.2, 3.7.3
Description: If a comment contained the phrases "bug X" or
             "attachment X", where X was an integer larger than the
             maximum 32-bit signed integer size, PostgreSQL would
             throw an error, and any page containing that comment would
             not be viewable. On most Bugzillas, any user can enter
             a comment on any bug, so any user could have used this to
             deny access to one or all bugs. Bugzillas running on
             databases other than PostgreSQL are not affected.
References:  https://bugzilla.mozilla.org/show_bug.cgi?id=583690
CVE Number:  CVE-2010-2759

Vulnerability Solutions
=======================

The fixes for these issues are included in the 3.2.8, 3.4.8, 3.6.2, and
3.7.3 releases. Upgrading to a release with the relevant fixes will
protect your installation from possible exploits of these issues.

If you are unable to upgrade but would like to patch just the
individual security vulnerabilities, there are patches available for
each issue at the "References" URL for each vulnerability.

Full release downloads, patches to upgrade Bugzilla from previous
versions, and CVS/bzr upgrade instructions are available at:

  http://www.bugzilla.org/download/


Credits
=======

The Bugzilla team wish to thank the following people/organizations for
their assistance in locating, advising us of, and assisting us to fix
this issue:

Frédéric Buclin
Max Kanat-Alexander
Byron Jones
Bradley Baetz
Slava Buhtiarov

General information about the Bugzilla bug-tracking system can be found
at:

  http://www.bugzilla.org/

Comments and follow-ups can be directed to the mozilla.support.bugzilla
newsgroup or the support-bugzilla mailing list.
http://www.bugzilla.org/support/ has directions for accessing these
forums.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkxbensACgkQaL2D/aEJPK7pqgCfaDg6ZAm1QyJjpzW/M/XxXwYY
abAAnR4Cz697AhUL17RdNlEuShCHWRvJ
=qEoW
-----END PGP SIGNATURE-----