Bugzilla 2.17.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2 generates different error messages depending on whether a product exists, which makes it easier for remote attackers to guess product names via unspecified use of the (1) Reports or (2) Duplicates page.

- Thu Aug 19 2010 Emmanuel Seyman <emmanuel.seyman at     club-internet.fr> - 3.4.8-2

    - Bump to correct changelog version

    - Wed Aug 18 2010 Emmanuel Seyman <emmanuel.seyman at       club-internet.fr> - 3.4.8-1

    - Update to 3.4.8 (#623426, #615331)

    - Only run checksetup if /etc/bugzilla/localconfig does       not exist (#610210)

    - Add bugzilla-contrib to Requires (#610198)

    - Wed Jun 30 2010 Emmanuel Seyman <emmanuel.seyman at       club-internet.fr> - 3.4.7-2

    - Remove mod_perl from the requirements (#600924)

    - Fri Jun 25 2010 Emmanuel Seyman <emmanuel.seyman at       club-internet.fr> - 3.4.7-1

    - Update to 3.4.7 (CVE-2010-1204)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Thu Aug 19 2010 Emmanuel Seyman <emmanuel.seyman at     club-internet.fr> - 3.4.8-1

    - Update to 3.4.8 (#623426, #615331)

    - Only run checksetup if /etc/bugzilla/localconfig does       not exist (#610210)

    - Add bugzilla-contrib to Requires (#610198)

    - Remove mod_perl from the requirements (#600924)

    - Fri Jun 25 2010 Emmanuel Seyman <emmanuel.seyman at       club-internet.fr> - 3.4.7-1

    - Update to 3.4.7 (CVE-2010-1204)

    - Mon Feb 1 2010 Emmanuel Seyman <emmanuel.seyman at       club-internet.fr> - 3.4.5-1

    - Update to 3.4.5 (CVE-2009-3989, CVE-2009-3387)

    - Remove bugzilla-EL5-perl-versions.patch which is       EPEL-specific

    - Thu Nov 19 2009 Emmanuel Seyman <emmanuel.seyman at       club-internet.fr> - 3.4.4-1

    - Update to 3.4.4 (CVE-2009-3386)

    - Wed Nov 11 2009 Emmanuel Seyman <emmanuel.seyman at       club-internet.fr> - 3.4.3-1

    - Update to 3.4.3 (fixes memory leak issues)

    - Add perl(Digest::SHA) in the Requires

    - Specify Perl module versions in the Requires (fixes       #524309)

    - Add an alias to make $webdotdir a working path (fixes       #458848)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Bug #623423 - CVE-2010-2756 CVE-2010-2757 CVE-2010-2758     CVE-2010-2759 bugzilla: multiple vulnerabilities     corrected in 3.4.8/3.6.2

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A Bugzilla Security Advisory reports :

- Remote Information Disclosure : An unprivileged user is normally not allowed to view other users' group membership. But boolean charts let the user use group-based pronouns, indirectly disclosing group membership. This security fix restricts the use of pronouns to groups the user belongs to.

- Notification Bypass : Normally, when a user is impersonated, he receives an email informing him that he is being impersonated, containing the identity of the impersonator. However, it was possible to impersonate a user without this notification being sent.

- Remote Information Disclosure : An error message thrown by the 'Reports' and 'Duplicates' page confirmed the non-existence of products, thus allowing users to guess confidential product names.
(Note that the 'Duplicates' page was not vulnerable in Bugzilla 3.6rc1 and above though.)

- Denial of Service : If a comment contained the phrases 'bug X' or 'attachment X', where X was an integer larger than the maximum 32-bit signed integer size, PostgreSQL would throw an error, and any page containing that comment would not be viewable. On most Bugzillas, any user can enter a comment on any bug, so any user could have used this to deny access to one or all bugs. Bugzillas running on databases other than PostgreSQL are not affected.

The remote web server is hosting Bugzilla, a web-based bug tracking application. 

Versions of Bugzilla 3.2.x earlier than 3.2.8, 3.4.x earlier than 3.4.8, 3.6.x earlier than 3.6.2, and 3.7.x earlier than 3.7.3 are potentially affected by multiple vulnerabilities :

  - It is possible to (at least partially) determine the membership of any group using the Search interface. (CVE-2010-2756).

  - It is possible to use the 'sudo' feature without sending a notification to the user being impersonated. (CVE-2010-2757)

  - The 'Reports' and 'Duplicates' pages let you guess the name of products you can't see, due to the error message that is thrown. (CVE-2010-2758)

  - For installations using PostgreSQL, specifying "bug X" or "Attachment X" in a comment can deny access to the bug if X is larger than the maximum 32-bit signed integer size. (CVE-2010-2759)

ID	Name	Product	Family	Severity
48914	Fedora 13 : bugzilla-3.4.8-2.fc13 (2010-13086)	Nessus	Fedora Local Security Checks	medium
48913	Fedora 12 : bugzilla-3.4.8-1.fc12 (2010-13072)	Nessus	Fedora Local Security Checks	medium
48897	Fedora 14 : bugzilla-3.6.2-1.fc14 (2010-13171)	Nessus	Fedora Local Security Checks	medium
48427	FreeBSD : bugzilla -- information disclosure, denial of service (8cbf4d65-af9a-11df-89b8-00151735203a)	Nessus	FreeBSD Local Security Checks	medium
5627	Bugzilla < 3.2.8 / 3.4.8 / 3.6.2 / 3.7.3 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium

Detections

Analytics

CVE-2010-2758

medium

Tenable Plugins

medium

medium

medium

medium

medium