Search.pm in Bugzilla 2.17.1 through 3.2.6, 3.3.1 through 3.4.6, 3.5.1 through 3.6, and 3.7 allows remote attackers to obtain potentially sensitive time-tracking information via a crafted search URL, related to a "boolean chart search."

The Bugzilla team has released v3.4.7 of their software, which fixes a remote information disclosure bug (users can search on time-tracking values even if they are not permitted to see them). See CVE-2010-1204 for all the gory details.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A Bugzilla Security Advisory reports :

- Normally, information about time-tracking (estimated hours, actual hours, hours worked, and deadlines) is restricted to users in the 'time-tracking group'. However, any user was able, by crafting their own search URL, to search for bugs based using those fields as criteria, thus possibly exposing sensitive time-tracking information by a user seeing that a bug matched their search.

- If $use_suexec was set to '1' in the localconfig file, then the localconfig file's permissions were set as world-readable by checksetup.pl. This allowed any user with local shell access to see the contents of the file, including the database password and the site_wide_secret variable used for CSRF protection.

The version of Bugzilla hosted on the remote web server allows an unauthenticated, remote attacker to execute a boolean chart search using time tracking fields such as 'estimated_time', 'remaining_time' 'work_time' 'actual_time', 'percentage_complete' or 'deadline' even though the attacker is not part of the group defined by 'timetrackinggroup' parameter.

Successful exploitation of this issue could allow an attacker to search for bugs that match one or more time tracking field criteria.

Although Nessus has not checked for it, the installed version is also likely to be affected by a local information disclosure issue that may allow a local user to read file 'localconfig' after checksetup.pl is run with '$use_suexec' is set to 1 in 'localconfig'.

In addition to this, the remote version of bugzilla is also vulnerable to an information disclosure issue due to bad permissions set to the 'localconfig' file, and the data/webdot and .bzr/ directories which might allow local users to read files they should otherwise not have access to.

The remote web server is hosting Bugzilla, a web-based bug tracking application.  

Versions of Bugzilla earlier than 3.2.7, 3.4.x earlier than 3.4.7, and 3.6.x earlier than 3.6.1 are potentially affected by multiple vulnerabilities :

  - It is possible to determine time-tracking information for bugs through specially crafted search URLs. (CVE-2010-1204)

  - If '$use_suexec' is set to '1' in the localconfig file, the localconfig file's permissions were set as world-readable by checksetup.pl. (CVE-2010-0180)

ID	Name	Product	Family	Severity
47675	Fedora 13 : bugzilla-3.4.7-2.fc13 (2010-10669)	Nessus	Fedora Local Security Checks	medium
47601	FreeBSD : bugzilla -- information disclosure (f1331504-8849-11df-89b8-00151735203a)	Nessus	FreeBSD Local Security Checks	medium
47597	Fedora 12 : bugzilla-3.4.7-1.fc12 (2010-10398)	Nessus	Fedora Local Security Checks	medium
47166	Bugzilla 'time-tracking' fields Information Disclosure	Nessus	CGI abuses	medium
5585	Bugzilla < 3.2.7 / 3.4.7 / 3.6.1 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium

Detections

Analytics

CVE-2010-1204

medium

Tenable Plugins

medium

medium

medium

medium

medium