CRLF injection vulnerability in Bugzilla before 3.2.9, 3.4.x before 3.4.9, 3.6.x before 3.6.3, and 4.0.x before 4.0rc1, when Server Push is enabled in a web browser, allows remote attackers to inject arbitrary HTTP headers and content, and conduct HTTP response splitting attacks, via a crafted URL.

A HTTP header injection attack was fixed in perl-CGI-Simple.
CVE-2010-2761 has been assigned to this issue.

Multiple header injection problems in the CGI module of perl have been fixed. They allowed to inject HTTP headers in responses.
CVE-2010-2761, CVE-2010-4410 and CVE-2010-4411 have been assigned to this issue.

The remote host is affected by the vulnerability described in GLSA-201110-03 (Bugzilla: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Bugzilla. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could conduct cross-site scripting attacks, conduct       script insertion and spoofing attacks, hijack the authentication of       arbitrary users, inject arbitrary HTTP headers, obtain access to       arbitrary accounts, disclose the existence of confidential groups and its       names, or inject arbitrary e-mail headers.
    A local attacker could disclose the contents of temporarfy files for       uploaded attachments.
  Workaround :

    There is no known workaround at this time.

Multiple header injection problems in the CGI module of perl have been fixed. They allowed to inject HTTP headers in responses.

  - have been assigned to this issue. (CVE-2010-2761 /     CVE-2010-4410 / CVE-2010-4411)

Multiple header injection problems in the CGI module of perl have been fixed. They allowed to inject HTTP headers in responses. CVE-2010-2761 / CVE-2010-4410 / CVE-2010-4411 have been assigned to this issue.

The version of Bugzilla hosted on the remote web server allows injection of arbitrary HTTP headers and content when Server Push is enabled in a browser.

Note that the install also likely creates restricted reports in a known location and with predictable names, which can lead to a loss of information, although Nessus has not checked for this.

The following security issues have been discovered in Bugzilla :

  - There is a way to inject both headers and content to     users, causing a serious Cross-Site Scripting     vulnerability.

  - It was possible to see graphs from Old Charts even if     you did not have access to a particular product, and you     could browse a particular URL to see all product names.

  - YUI 2.8.1, which shipped with Bugzilla starting with     3.7.x, contained a security vulnerability. The version     of YUI shipped with Bugzilla 4.0rc1 and above has been     updated to 2.8.2.

These are tracked by CVE-2010-3764.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote web server is hosting Bugzilla, a web-based bug tracking application.

Versions of Bugzilla 3.2.x earlier than 3.2.9, 3.4.x earlier than 3.4.9, and 3.6.x earlier than 3.6.3 are potentially affected by multiple vulnerabilities :

  - By inserting a certain string into a URL, it is possible to inject both headers and content to any browser that supports "Server Push". (CVE-2010-3172)

  - The Charts system generates graphs with predictable names into the 'graphs/' directory, which can also be browsed to see its contents. (CVE-2010-3764)

  - YUI 2.8.1 is vulnerable to a cross-site scripting vulnerability in certain .swf files.

ID	Name	Product	Family	Severity
75708	openSUSE Security Update : perl-CGI-Simple (openSUSE-SU-2011:0020-1)	Nessus	SuSE Local Security Checks	medium
75705	openSUSE Security Update : perl (openSUSE-SU-2011:0064-1)	Nessus	SuSE Local Security Checks	medium
56445	GLSA-201110-03 : Bugzilla: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
53790	openSUSE Security Update : perl-CGI-Simple (openSUSE-SU-2011:0020-1)	Nessus	SuSE Local Security Checks	medium
53789	openSUSE Security Update : perl (openSUSE-SU-2011:0064-1)	Nessus	SuSE Local Security Checks	medium
51641	SuSE 10 Security Update : Perl (ZYPP Patch Number 7316)	Nessus	SuSE Local Security Checks	medium
51630	SuSE 11.1 Security Update : perl (SAT Patch Number 3804)	Nessus	SuSE Local Security Checks	medium
50599	Bugzilla Response Splitting	Nessus	CGI abuses	medium
50596	Fedora 13 : bugzilla-3.4.9-1.fc13 (2010-17280)	Nessus	Fedora Local Security Checks	medium
50595	Fedora 14 : bugzilla-3.6.3-1.fc14 (2010-17274)	Nessus	Fedora Local Security Checks	medium
50594	Fedora 12 : bugzilla-3.4.9-1.fc12 (2010-17235)	Nessus	Fedora Local Security Checks	medium
5700	Bugzilla < 3.2.9 / 3.4.9 / 3.6.3 Multiple Vulnerabilities	Nessus Network Monitor	CGI	high

Detections

Analytics

CVE-2010-3172

medium

Tenable Plugins

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

high