Bugzilla 3.5.x and 3.6.x before 3.6.9, 3.7.x and 4.0.x before 4.0.6, and 4.1.x and 4.2.x before 4.2.1, when the inbound_proxies option is enabled, does not properly validate the X-Forwarded-For HTTP header, which allows remote attackers to bypass the lockout policy via a series of authentication requests with (1) different IP address strings in this header or (2) a long string in this header.

The following security issues have been discovered in Bugzilla :

  - When abusing the X-FORWARDED-FOR header, an attacker     could bypass the lockout policy allowing a possible     brute-force discovery of a valid user password.

  - An attacker can get access to some bug information using     the victim's credentials using a specially crafted HTML     page.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A Bugzilla Security Advisory reports : The following security issues have been discovered in Bugzilla : Unauthorized Access Due to a lack of proper validation of the X-FORWARDED-FOR header of an authentication request, an attacker could bypass the current lockout policy used for protection against brute- force password discovery.
This vulnerability can only be exploited if the 'inbound_proxies' parameter is set. Cross Site Scripting A JavaScript template used by buglist.cgi could be used by a malicious script to permit an attacker to gain access to some information about bugs he would not normally be allowed to see, using the victim's credentials. To be exploitable, the victim must be logged in when visiting the attacker's malicious page.

All affected installations are encouraged to upgrade as soon as possible.

ID	Name	Product	Family	Severity
58960	Fedora 17 : bugzilla-4.0.6-1.fc17 (2012-6282)	Nessus	Fedora Local Security Checks	medium
58931	Fedora 15 : bugzilla-3.6.9-1.fc15 (2012-6396)	Nessus	Fedora Local Security Checks	medium
58928	Fedora 16 : bugzilla-4.0.6-1.fc16 (2012-6368)	Nessus	Fedora Local Security Checks	medium
58828	FreeBSD : bugzilla -- multiple vulnerabilities (09c87973-8b9d-11e1-b393-20cf30e32f6d)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2012-0465

high

Tenable Plugins

medium

medium

medium

medium