Search.pm in Bugzilla 2.19.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2 allows remote attackers to determine the group memberships of arbitrary users via vectors involving the Search interface, boolean charts, and group-based pronouns.

- Thu Aug 19 2010 Emmanuel Seyman <emmanuel.seyman at     club-internet.fr> - 3.4.8-2

    - Bump to correct changelog version

    - Wed Aug 18 2010 Emmanuel Seyman <emmanuel.seyman at       club-internet.fr> - 3.4.8-1

    - Update to 3.4.8 (#623426, #615331)

    - Only run checksetup if /etc/bugzilla/localconfig does       not exist (#610210)

    - Add bugzilla-contrib to Requires (#610198)

    - Wed Jun 30 2010 Emmanuel Seyman <emmanuel.seyman at       club-internet.fr> - 3.4.7-2

    - Remove mod_perl from the requirements (#600924)

    - Fri Jun 25 2010 Emmanuel Seyman <emmanuel.seyman at       club-internet.fr> - 3.4.7-1

    - Update to 3.4.7 (CVE-2010-1204)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Thu Aug 19 2010 Emmanuel Seyman <emmanuel.seyman at     club-internet.fr> - 3.4.8-1

    - Update to 3.4.8 (#623426, #615331)

    - Only run checksetup if /etc/bugzilla/localconfig does       not exist (#610210)

    - Add bugzilla-contrib to Requires (#610198)

    - Remove mod_perl from the requirements (#600924)

    - Fri Jun 25 2010 Emmanuel Seyman <emmanuel.seyman at       club-internet.fr> - 3.4.7-1

    - Update to 3.4.7 (CVE-2010-1204)

    - Mon Feb 1 2010 Emmanuel Seyman <emmanuel.seyman at       club-internet.fr> - 3.4.5-1

    - Update to 3.4.5 (CVE-2009-3989, CVE-2009-3387)

    - Remove bugzilla-EL5-perl-versions.patch which is       EPEL-specific

    - Thu Nov 19 2009 Emmanuel Seyman <emmanuel.seyman at       club-internet.fr> - 3.4.4-1

    - Update to 3.4.4 (CVE-2009-3386)

    - Wed Nov 11 2009 Emmanuel Seyman <emmanuel.seyman at       club-internet.fr> - 3.4.3-1

    - Update to 3.4.3 (fixes memory leak issues)

    - Add perl(Digest::SHA) in the Requires

    - Specify Perl module versions in the Requires (fixes       #524309)

    - Add an alias to make $webdotdir a working path (fixes       #458848)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Bug #623423 - CVE-2010-2756 CVE-2010-2757 CVE-2010-2758     CVE-2010-2759 bugzilla: multiple vulnerabilities     corrected in 3.4.8/3.6.2

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A Bugzilla Security Advisory reports :

- Remote Information Disclosure : An unprivileged user is normally not allowed to view other users' group membership. But boolean charts let the user use group-based pronouns, indirectly disclosing group membership. This security fix restricts the use of pronouns to groups the user belongs to.

- Notification Bypass : Normally, when a user is impersonated, he receives an email informing him that he is being impersonated, containing the identity of the impersonator. However, it was possible to impersonate a user without this notification being sent.

- Remote Information Disclosure : An error message thrown by the 'Reports' and 'Duplicates' page confirmed the non-existence of products, thus allowing users to guess confidential product names.
(Note that the 'Duplicates' page was not vulnerable in Bugzilla 3.6rc1 and above though.)

- Denial of Service : If a comment contained the phrases 'bug X' or 'attachment X', where X was an integer larger than the maximum 32-bit signed integer size, PostgreSQL would throw an error, and any page containing that comment would not be viewable. On most Bugzillas, any user can enter a comment on any bug, so any user could have used this to deny access to one or all bugs. Bugzillas running on databases other than PostgreSQL are not affected.

The remote web server is hosting Bugzilla, a web-based bug tracking application. 

Versions of Bugzilla 3.2.x earlier than 3.2.8, 3.4.x earlier than 3.4.8, 3.6.x earlier than 3.6.2, and 3.7.x earlier than 3.7.3 are potentially affected by multiple vulnerabilities :

  - It is possible to (at least partially) determine the membership of any group using the Search interface. (CVE-2010-2756).

  - It is possible to use the 'sudo' feature without sending a notification to the user being impersonated. (CVE-2010-2757)

  - The 'Reports' and 'Duplicates' pages let you guess the name of products you can't see, due to the error message that is thrown. (CVE-2010-2758)

  - For installations using PostgreSQL, specifying "bug X" or "Attachment X" in a comment can deny access to the bug if X is larger than the maximum 32-bit signed integer size. (CVE-2010-2759)

The version of Bugzilla hosted on the remote web server allows an unauthenticated, remote attacker to perform a boolean chart search using the 'reporter' field set to an arbitrary group.

An attacker could leverage this issue to search for bugs that were reported by users belonging to one more groups, even though the attacker is not a member of such groups.

Although Nessus has not checked for them, the installed version is also likely to be affected by several other vulnerabilities, including remote information disclosure, denial of service and notification bypass.

ID	Name	Product	Family	Severity
48914	Fedora 13 : bugzilla-3.4.8-2.fc13 (2010-13086)	Nessus	Fedora Local Security Checks	medium
48913	Fedora 12 : bugzilla-3.4.8-1.fc12 (2010-13072)	Nessus	Fedora Local Security Checks	medium
48897	Fedora 14 : bugzilla-3.6.2-1.fc14 (2010-13171)	Nessus	Fedora Local Security Checks	medium
48427	FreeBSD : bugzilla -- information disclosure, denial of service (8cbf4d65-af9a-11df-89b8-00151735203a)	Nessus	FreeBSD Local Security Checks	medium
5627	Bugzilla < 3.2.8 / 3.4.8 / 3.6.2 / 3.7.3 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium
48316	Bugzilla 'reporter' field Information Disclosure	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2010-2756

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium