Security advisory for Bugzilla 4.3.2, 4.2.2, 4.0.7 and 3.6.10

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Summary
=======

Bugzilla is a Web-based bug-tracking system used by a large number of
software projects. The following security issues have been discovered
in Bugzilla:

* In HTML bugmails, an improper validation of the permissions of the
  addressee can lead to confidential information about bugs and
  attachments to be visible to the addressee.

* The description of a private attachment can be visible to a user
  who hasn't permissions to access this attachment if the attachment
  ID is mentioned in a comment in a bug.

All affected installations are encouraged to upgrade as soon as
possible.


Vulnerability Details
=====================

Class:       Information Leak
Versions:    4.1.1 to 4.2.1, 4.3.1
Fixed In:    4.2.2, 4.3.2
Description: In HTML bugmails, all bug IDs and attachment IDs are
             linkified, and hovering these links displays a tooltip
             with the bug summary or the attachment description if
             the user is allowed to see the bug or attachment.
             But when validating user permissions when generating the
             email, the permissions of the user who edited the bug were
             taken into account instead of the permissions of the
             addressee. This means that confidential information could
             be disclosed to the addressee if the other user has more
             privileges than the addressee.
             Plain text bugmails are not affected as bug and attachment
             IDs are not linkified.
References:  https://bugzilla.mozilla.org/show_bug.cgi?id=777398
CVE Number:  CVE-2012-1968

Class:       Information Leak
Versions:    2.17.5 to 3.6.9, 3.7.1 to 4.0.6, 4.1.1 to 4.2.1, 4.3.1
Fixed In:    3.6.10, 4.0.7, 4.2.2, 4.3.2
Description: The description of a private attachment could be visible
             to a user who hasn't permissions to access this attachment
             if the attachment ID is mentioned in a public comment in
             a bug that the user can see.
References:  https://bugzilla.mozilla.org/show_bug.cgi?id=777586
CVE Number:  CVE-2012-1969


Vulnerability Solutions
=======================

The fixes for these issues are included in the 3.6.10, 4.0.7, 4.2.2 and
4.3.2 releases. Upgrading to a release with the relevant fixes will
protect your installation from possible exploits of these issues.

If you are unable to upgrade but would like to patch just these
individual security vulnerabilities, there are patches available for
the issues at the "References" URL for each vulnerability.

Full release downloads, patches to upgrade Bugzilla from previous
versions, and CVS/bzr upgrade instructions are available at:

  http://www.bugzilla.org/download/


Credits
=======

The Bugzilla team wish to thank the following people/organizations for
their assistance in locating, advising us of, and assisting us in
fixing these issues:

Fr�d�ric Buclin
Byron Jones

General information about the Bugzilla bug-tracking system can be found
at:

  http://www.bugzilla.org/

Comments and follow-ups can be directed to the mozilla.support.bugzilla
newsgroup or the support-bugzilla mailing list.
http://www.bugzilla.org/support/ has directions for accessing these
forums.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBAgAGBQJQEjFtAAoJEJZXZhv5X1hq3MUP+gNFYjA4wnbneHIEIGMxA26C
AwMCH9MyxhzncmZUP4uUayx4wpcO/YvtS25ePPmXcDyjySXNPb+sg+dLCudCUTq+
XJTvX62I2xItp5KqvVmowIiUGAWemjpIeb2A+ESexewuGoN5uwI0u2S3xF6gemK0
Tqrz5qjgypNAUhKBazYSnH7zV4ZJ94PGb0ttHOU+HdtrN6yN4zM3jUvXfYCztqIZ
ToarRf/pONS6k5/ac0C4YFzgNiQd8BJCTQoh7IB3oa5diqhAoAfnMqBluccbjmFx
npgL/E2zO3TrXSIDH++DmMjVyf52tJMAkHNQ3VSb5Rb8joCpKII33RiJKjImUHn1
6TSKTmNIWfOwD03C/XUdb2tdTzFcGJ6D0O8t2jA+4+f/R+eGwreUT6l6t5Wo6EEJ
y6JWoZJcE+QTxmQT9D6zaUbFM1tpCgnoSWKVq7J4+aAS12cRfQP2GMcia9R1XV7c
+NfO5OcoT55KoCXPlZt9AZuW4lcHp4TysfoH8DGHVJkPgQaUSE0bYoY/EsuPr/53
mkDab5AX7PGtJ8yckRw9t4XTFuNoGCmUDB7Q8lJBqg48qvVtucKTj6svrb/HvtST
fve87GdL5G7rGfVrCUbM/LExMxn0yMliNPmbI1igjU4SIDQqA+wFAI1n0+6jipSj
jGdz1zRVRTH2cyS3VCCO
=NlBi
-----END PGP SIGNATURE-----
0
ISO
7/27/2012 6:13:01 AM
mozilla.support.bugzilla 10182 articles. 0 followers. Post Follow

0 Replies
1564 Views

Similar Articles

[PageSpeed] 32
Get it on Google Play
Get it on Apple App Store

Reply:

Similar Artilces:

[ANN] Release of Bugzilla 4.3.2, 4.2.2, 4.0.7, and 3.6.10
Today we are releasing 4.2.2, 4.0.7, 3.6.10, and the unstable development snapshot 4.3.2. All of today's releases contain security fixes. We recommend all Bugzilla administrators to read the Security Advisory linked below. Bugzilla 4.2.2 is our latest stable release. It contains various useful bug fixes and security fixes for the 4.2 branch. Bugzilla 4.0.7 and 3.6.10 are security updates for the 4.0 branch and the 3.6 branch, respectively. 4.0.7 also contains several bug fixes. Note that 4.3.2 is an unstable development release and should not be used in producti...

[ANN] Security Advisory for Bugzilla 3.0.10, 3.2.5, 3.4.4, and 3.5.2
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Summary ======= Bugzilla is a Web-based bug-tracking system, used by a large number of software projects. This advisory covers two security issues that have recently been fixed in the Bugzilla code: + Some files stored on the web server are not correctly protected against external access and can be viewed from a web browser. + Restricting a bug to a group while moving the bug to another product has no effect if the group is not used by both products. The bug may become public if no other group restriction applies. All...

Security advisory for Bugzilla 4.4rc2, 4.2.5, 4.0.10 and 3.6.13 #2
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Summary ======= Bugzilla is a Web-based bug-tracking system used by a large number of software projects. The following security issues have been discovered in Bugzilla: * When viewing a bug report, a bug ID containing random code is not correctly sanitized in the HTML page if the specified page format is invalid. This can lead to XSS. * When running a query in debug mode, it is possible to determine if a given confidential field value (such as a product name) exists. Bugzilla 4.1 and newer are not affected by this issue....

Security advisory for Bugzilla 4.3.3, 4.2.3, 4.0.8 and 3.6.11
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Summary ======= Bugzilla is a Web-based bug-tracking system used by a large number of software projects. The following security issues have been discovered in Bugzilla: * When the user logs in using LDAP, the username is not escaped before being passed to LDAP which could potentially lead to LDAP injection. * Extensions are not protected against directory browsing by default and users can view the source code of templates used by the extensions. These templates may contain sensitive data. All affected installations ar...

[ANN] Security Advisory for Bugzilla 3.2.7, 3.4.7, 3.6.1, and 3.7.2
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Summary ======= Bugzilla is a Web-based bug-tracking system used by a large number of software projects. The following security issues have been discovered in Bugzilla: * It was possible to (at least partially) determine the membership of any group using the Search interface. * It was possible to use the 'sudo' feature without sending a notification to the user being impersonated. * The 'Reports' and 'Duplicates' pages let you guess the name of products you could not see, due to the error message ...

[ANN] Security Advisory for Bugzilla Versions Prior to 3.4.12, 3.6.6, 4.0.2, and 4.1.3
Summary ======= Bugzilla is a Web-based bug-tracking system used by a large number of software projects. The following security issues have been discovered in Bugzilla: * Internet Explorer 8 and older, and Safari before 5.0.6 do content sniffing when viewing a patch in "Raw Unified" mode, which could trigger a cross-site scripting attack due to the execution of malicious code in the attachment. * It is possible to determine whether or not certain group names exist while creating or updating bugs; and in Bugzilla 4.1.1 and 4.1.2, also by using custom se...

[ANN] Security Advisory for Bugzilla 3.2.8, 3.4.8, 3.6.2, and 3.7.3
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Summary ======= Bugzilla is a Web-based bug-tracking system used by a large number of software projects. The following security issues have been discovered in Bugzilla: * There is a way to inject both headers and content to users, causing a serious Cross-Site Scripting vulnerability. * It was possible to see graphs from Old Charts even if you did not have access to a particular product, and you could browse a particular URL to see all product names. * YUI 2.8.1, which shipped with Bugzilla starting with 3.7.x, contain...

Security advisory for Bugzilla 4.5.6, 4.4.6, 4.2.11, and 4.0.15 #2
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Summary ======= Bugzilla is a Web-based bug-tracking system used by a large number of software projects. The following security issues have been discovered in Bugzilla: * The 'realname' parameter is not correctly filtered on user account creation, which could lead to user data override. * Several places were found in the Bugzilla code where cross-site scripting attacks could be used to access sensitive information. * Private comments can be shown to flagmail recipients who aren't in the insider group * Specially...

Security advisory for Bugzilla 4.5.3, 4.4.3, 4.2.8, and 4.0.12
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Summary ======= Bugzilla is a Web-based bug-tracking system used by a large number of software projects. The following security issues have been discovered in Bugzilla: * The login form had no CSRF protection, meaning that an attacker could force the victim to log in using the attacker's credentials. * Dangerous control characters can be inserted into Bugzilla, notably into bug comments, which can then be used to execute local commands. All affected installations are encouraged to upgrade as soon as possible. Vuln...

Security advisory for Bugzilla 4.4rc2, 4.2.5, 4.0.10 and 3.6.13
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Summary ======= Bugzilla is a Web-based bug-tracking system used by a large number of software projects. The following security issues have been discovered in Bugzilla: * When viewing a bug report, a bug ID containing random code is not correctly sanitized in the HTML page if the specified page format is invalid. This can lead to XSS. * When running a query in debug mode, it is possible to determine if a given confidential field value (such as a product name) exists. Bugzilla 4.1 and newer are not affected by this issue....

[ANN] Release of Bugzilla 3.0.4, 3.1.4, 2.22.4, and 2.20.6
--Sig_/APAQZZ+qGwu.Hq/UgkhiOAo Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: quoted-printable The Bugzilla project has four releases today! Bugzilla 3.0.4 is the latest stable version of Bugzilla, containing several useful bug fixes over 3.0.3, particularly for the inbound email interface. Bugzilla 3.1.4 is our latest unstable development preview. It should be more stable than 3.1.3, though we still don't recommend it for production environments. Provided we don't find too many major issues in this release, our next release will be Bugzilla...

Security advisory for Bugzilla 4.4rc1, 4.2.4, 4.0.9 and 3.6.12
Summary ======= Bugzilla is a Web-based bug-tracking system used by a large number of software projects. The following security issues have been discovered in Bugzilla: * Confidential product and component names can be disclosed to unauthorized users if they are used to control the visibility of a custom field. * When calling the 'User.get' WebService method with a 'groups' argument, it is possible to check if the given group names exist or not. * Due to incorrectly filtered field values in tabular reports, it is possible to inject code which can l...

[ANN] Release of Bugzilla 3.2.10, 3.4.10, 3.6.4, and 4.0rc2
Some serious security issues were discovered in Bugzilla, and as a result we have four security releases for you today. We recommend that all Bugzilla administrators read the Security Advisory that was published along with these releases, and we also recommend that you update as soon as possible. Bugzilla 4.0rc2 is our second Release Candidate for Bugzilla 4.0. This release has received QA testing and should be considerably more stable than the development releases before it. It is still not considered fully stable, and so you should understand that if you use it, you use it at ...

[ANN] Security Advisory for Bugzilla 3.2.6, 3.4.6, 3.6, and 3.7
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Summary ======= Bugzilla is a Web-based bug-tracking system used by a large number of software projects. The following security issues have been discovered in Bugzilla: * Everybody could search for time-tracking information, not just members of the timetrackinggroup. * Under suexec, "localconfig" was world-readable, meaning that local users with shell access to the Bugzilla server may have been able to see the database password and the site_wide_secret. All affected installations are encouraged to upgrade as so...

Web resources about - Security advisory for Bugzilla 4.3.2, 4.2.2, 4.0.7 and 3.6.10 - mozilla.support.bugzilla

Krebs on Security
The House Financial Services Committee is slated to hold a hearing this Friday on the impact of cyber heists against small- to mid-sized businesses. ...

Security Middle East - Latest news from the Middle East.
Security Middle East is a news portal for the entire security industry, focussed specifically on latest security news from the Middle East. Security ...

Information Security News, IT Security News & Expert Insights: SecurityWeek.Com
IT Security News and Information Security News, Cyber Security, Network Security, Enterprise Security Threats, Cybercrime News and more. Information ...

Committee on National Security Systems - Wikipedia, the free encyclopedia
The National Security Telecommunications and Information Systems Security Committee (NSTISSC) was established under National Security Directive ...

Euro 2016 organizers focus on security following Paris attacks
Since the Paris attacks, the private security business is so busy that its regulator in France is cautioning that the European Championships ...

NBC News Beefs Up Intelligence, National Security Reporting
NBC News has hired former Associated Press national security reporter Ken Dilanian to join its Investigative Unit. TVNewser has obtained a memo ...

CBT Nuggets Announces Cisco Security Course
New video training course with Keith Barker covers Cisco CCNA security topics and technologies. Eugene, Oregon (PRWEB) December 11, 2015 CBT ...

Data security is key for customer retention
... victim of a breach during the holiday season. Only a quarter (25 percent) of all respondents feel that companies take the protection and security ...

Homeland Security gets involved in search for missing Afghans
Afghan men disappeared while training with U.S. military at south Georgia base

Internet-connected coffee maker has security holes
... discovers problems with his Internet-connected coffee maker that could open up his PC to attackers. An Australian man has discovered security ...

Resources last updated: 12/14/2015 3:29:52 AM