The get_attachment_link function in Template.pm in Bugzilla 2.x and 3.x before 3.6.10, 3.7.x and 4.0.x before 4.0.7, 4.1.x and 4.2.x before 4.2.2, and 4.3.x before 4.3.2 does not check whether an attachment is private before presenting the attachment description within a public comment, which allows remote attackers to obtain sensitive description information by reading a comment.

Multiple vulnerablilities was identified and fixed in bugzilla :

The get_attachment_link function in Template.pm in Bugzilla 2.x and 3.x before 3.6.10, 3.7.x and 4.0.x before 4.0.7, 4.1.x and 4.2.x before 4.2.2, and 4.3.x before 4.3.2 does not check whether an attachment is private before presenting the attachment description within a public comment, which allows remote attackers to obtain sensitive description information by reading a comment (CVE-2012-1969).

Auth/Verify/LDAP.pm in Bugzilla 2.x and 3.x before 3.6.11, 3.7.x and 4.0.x before 4.0.8, 4.1.x and 4.2.x before 4.2.3, and 4.3.x before 4.3.3 does not restrict the characters in a username, which might allow remote attackers to inject data into an LDAP directory via a crafted login attempt (CVE-2012-3981).

Cross-site scripting (XSS) vulnerability in Bugzilla 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1, allows remote attackers to inject arbitrary web script or HTML via a field value that is not properly handled during construction of a tabular report, as demonstrated by the Version field (CVE-2012-4189).

Bugzilla/Attachment.pm in attachment.cgi in Bugzilla 2.x and 3.x before 3.6.12, 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1 allows remote attackers to read attachment descriptions from private bugs via an obsolete=1 insert action (CVE-2012-4197).

The User.get method in Bugzilla/WebService/User.pm in Bugzilla 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1 has a different outcome for a groups request depending on whether a group exists, which allows remote authenticated users to discover private group names by observing whether a call throws an error (CVE-2012-4198).

template/en/default/bug/field-events.js.tmpl in Bugzilla 3.x before 3.6.12, 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1 generates JavaScript function calls containing private product names or private component names in certain circumstances involving custom-field visibility control, which allows remote attackers to obtain sensitive information by reading HTML source code (CVE-2012-4199).

Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.8.0 through 2.9.0, as used in Bugzilla 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1, allows remote attackers to inject arbitrary web script or HTML via vectors related to swfstore.swf, a similar issue to CVE-2010-4209 (CVE-2012-5883).

Cross-site scripting (XSS) vulnerability in show_bug.cgi in Bugzilla before 3.6.13, 3.7.x and 4.0.x before 4.0.10, 4.1.x and 4.2.x before 4.2.5, and 4.3.x and 4.4.x before 4.4rc2 allows remote attackers to inject arbitrary web script or HTML via the id parameter in conjunction with an invalid value of the format parameter (CVE-2013-0785).

The Bugzilla::Search::build_subselect function in Bugzilla 2.x and 3.x before 3.6.13 and 3.7.x and 4.0.x before 4.0.10 generates different error messages for invalid product queries depending on whether a product exists, which allows remote attackers to discover private product names by using debug mode for a query (CVE-2013-0786).

The updated packages have upgraded to the 4.2.5 version which is not vulnerable to these issues

According to its banner, the version of Bugzilla installed on the remote host is affected by multiple information disclosure vulnerabilities :

  - In HTML bugmails, all bug IDs and attachment IDs are     linkified, and hovering these links displays a tooltip     with the bug summary or the attachment description if     the user is allowed to see the bug or attachment.  But     when validating user permissions when generating the     email, the permissions of the user who edited the bug     were taken into account instead of the permissions of     the addressee. This means that confidential information     could be disclosed to the addressee if the other user     has more privileges than the addressee. (CVE-2012-1968)

  - The description of a private attachment could be     visible to a user without permissions to access the     attachment if the attachment ID is mentioned in a     public comment that the user can see. (CVE-2012-1969)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

These versions of Bugzilla fix an information leak that allows an unprivileged user to read the description of a private attachment.

See https://bugzilla.mozilla.org/show_bug.cgi?id=777586 for all the details.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A Bugzilla Security Advisory reports : The following security issues have been discovered in Bugzilla : Information Leak Versions: 4.1.1 to 4.2.1, 4.3.1

In HTML bugmails, all bug IDs and attachment IDs are linkified, and hovering these links displays a tooltip with the bug summary or the attachment description if the user is allowed to see the bug or attachment. But when validating user permissions when generating the email, the permissions of the user who edited the bug were taken into account instead of the permissions of the addressee. This means that confidential information could be disclosed to the addressee if the other user has more privileges than the addressee. Plain text bugmails are not affected as bug and attachment IDs are not linkified.
Information Leak Versions: 2.17.5 to 3.6.9, 3.7.1 to 4.0.6, 4.1.1 to 4.2.1, 4.3.1

The description of a private attachment could be visible to a user who hasn't permissions to access this attachment if the attachment ID is mentioned in a public comment in a bug that the user can see.

ID	Name	Product	Family	Severity
66080	Mandriva Linux Security Advisory : bugzilla (MDVSA-2013:066)	Nessus	Mandriva Local Security Checks	medium
61650	Bugzilla < 3.6.10 / 4.0.7 / 4.2.2 / 4.3.2 Multiple Information Disclosures	Nessus	CGI abuses	medium
61497	Fedora 17 : bugzilla-4.0.7-1.fc17 (2012-11364)	Nessus	Fedora Local Security Checks	medium
61496	Fedora 16 : bugzilla-4.0.7-1.fc16 (2012-11324)	Nessus	Fedora Local Security Checks	medium
60151	FreeBSD : bugzilla -- multiple vulnerabilities (58253655-d82c-11e1-907c-20cf30e32f6d)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2012-1969

medium

Tenable Plugins

medium

medium

medium

medium

medium