The Old Charts implementation in Bugzilla 2.12 through 3.2.8, 3.4.8, 3.6.2, 3.7.3, and 4.1 creates graph files with predictable names in graphs/, which allows remote attackers to obtain sensitive information via a modified URL.

The remote host is affected by the vulnerability described in GLSA-201110-03 (Bugzilla: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Bugzilla. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could conduct cross-site scripting attacks, conduct       script insertion and spoofing attacks, hijack the authentication of       arbitrary users, inject arbitrary HTTP headers, obtain access to       arbitrary accounts, disclose the existence of confidential groups and its       names, or inject arbitrary e-mail headers.
    A local attacker could disclose the contents of temporarfy files for       uploaded attachments.
  Workaround :

    There is no known workaround at this time.

The following security issues have been discovered in Bugzilla :

  - There is a way to inject both headers and content to     users, causing a serious Cross-Site Scripting     vulnerability.

  - It was possible to see graphs from Old Charts even if     you did not have access to a particular product, and you     could browse a particular URL to see all product names.

  - YUI 2.8.1, which shipped with Bugzilla starting with     3.7.x, contained a security vulnerability. The version     of YUI shipped with Bugzilla 4.0rc1 and above has been     updated to 2.8.2.

These are tracked by CVE-2010-3764.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote web server is hosting Bugzilla, a web-based bug tracking application.

Versions of Bugzilla 3.2.x earlier than 3.2.9, 3.4.x earlier than 3.4.9, and 3.6.x earlier than 3.6.3 are potentially affected by multiple vulnerabilities :

  - By inserting a certain string into a URL, it is possible to inject both headers and content to any browser that supports "Server Push". (CVE-2010-3172)

  - The Charts system generates graphs with predictable names into the 'graphs/' directory, which can also be browsed to see its contents. (CVE-2010-3764)

  - YUI 2.8.1 is vulnerable to a cross-site scripting vulnerability in certain .swf files.

ID	Name	Product	Family	Severity
56445	GLSA-201110-03 : Bugzilla: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
50596	Fedora 13 : bugzilla-3.4.9-1.fc13 (2010-17280)	Nessus	Fedora Local Security Checks	medium
50595	Fedora 14 : bugzilla-3.6.3-1.fc14 (2010-17274)	Nessus	Fedora Local Security Checks	medium
50594	Fedora 12 : bugzilla-3.4.9-1.fc12 (2010-17235)	Nessus	Fedora Local Security Checks	medium
5700	Bugzilla < 3.2.9 / 3.4.9 / 3.6.3 Multiple Vulnerabilities	Nessus Network Monitor	CGI	high

Detections

Analytics

CVE-2010-3764

high

Tenable Plugins

high

medium

medium

medium

high