Security bugs are reported here via bugzilla

[Seth Alan Woolley <seth AT positivism.org>]

fixed:
2.16.4 or newer
2.17.5 or newer

We are on 2.17.4, but since this isn't a dangerous vuln, I'll let Sergey
handle this update and integrate it to stable when I see his perforce
updates come across.  I currently don't have an easy way to test if the
update works since I don't have an existing bugzilla install.

Seth

On Mon, Nov 03, 2003 at 01:32:35PM -0800, Seth Alan Woolley wrote:
> ----- Forwarded message from David Miller <justdave AT bugzilla.org> -----
> 
> Date: Mon, 3 Nov 2003 00:13:39 -0500
> To: bugtraq AT securityfocus.com, announce AT bugzilla.org,
>         mozilla-announce AT mozilla.org, mozilla-webtools AT mozilla.org
> From: David Miller <justdave AT bugzilla.org>
> Subject: [BUGZILLA] Security Advisory - SQL injection, information leak
> 
> Bugzilla Security Advisory
> 
> November 2, 2003
> 
> Summary
> =======
> 
> Bugzilla is a Web-based bug-tracking system, currently used by a large
> number of software projects.
> 
> This advisory covers security bugs that have recently been discovered
> and fixed in the Bugzilla code: two instances of arbitrary SQL injection
> exploitable only by a privileged user, one instance where a privileged
> user may retain privileges that should have been removed, and two
> instances of unprivileged access to summaries of restricted data.
> 
> These bugs are not considered critical, since their impact is quite
> limited. Nevertheless, all Bugzilla installations are advised to upgrade
> to the latest stable version of Bugzilla, 2.16.4, which was released
> today.
> 
> Development snapshots prior to version 2.17.5 are also affected, so if
> you are using a development snapshot, you should obtain a newer one
> (2.17.5) or use CVS to update.
> 
> 
> Vulnerability Details
> =====================
> 
> Issue 1
> -------
> Class:       SQL injection (by privileged user only)
> Versions:    2.16.3 and earlier (2.17.1 and up are not affected)
> Description: A user with 'editproducts' privileges (i.e. usually an
>              administrator) can select arbitrary SQL to be run by the
>              nightly statistics cron job (collectstats.pl), by giving a
>              product a special name.
> Reference:   http://bugzilla.mozilla.org/show_bug.cgi?id=214290
> 
> Issue 2
> -------
> Class:       SQL injection (by privileged user only)
> Versions:    2.16.3 and earlier, 2.17.1 through 2.17.4
> Description: A user with 'editkeywords' privileges (i.e. usually an
>              administrator) can inject arbitrary SQL via the URL used to
>              edit an existing keyword.
> Reference:   http://bugzilla.mozilla.org/show_bug.cgi?id=219044
> 
> Issue 3
> -------
> Class:       Privilege mishandling
> Versions:    2.16.3 and earlier (2.17.1 and up are not affected)
> Description: When deleting products and the 'usebuggroups' parameter is
>              on, the privilege which allows someone to add people to the
>              group which is being deleted does not get removed, allowing
>              people with that privilege to get that privilege for the
>              next group that is created which reuses that group ID.
>              Note that this only allows someone who had been granted
>              privileges in the past to retain them.
> Reference:   http://bugzilla.mozilla.org/show_bug.cgi?id=219690
> 
> Issue 4
> -------
> Class:       Information leak
> Versions:    2.16.3 and earlier, 2.17.1 through 2.17.4
> Description: If you know the email address of someone who has voted on a
>              secure bug, you can access the summary of that bug even if
>              you do not have sufficient permissions to view the bug
>              itself.
> Reference:   http://bugzilla.mozilla.org/show_bug.cgi?id=209376
> 
> Issue 5
> -------
> Class:       Information leak
> Versions:    2.17.3 and 2.17.4 only
> Description: Under some circumstances, a user can obtain component
>              descriptions for a product to which he does not normally
>              have access.
> Reference:   http://bugzilla.mozilla.org/show_bug.cgi?id=209742
> 
> 
> Vulnerability Solutions
> =======================
> 
> The fixes for all of the security bugs mentioned in this advisory
> are included in the 2.16.4 and 2.17.5 releases.  Upgrading to these
> releases will protect installations from these issues.
> 
> Full release downloads, patches to upgrade Bugzilla to 2.16.4 from
> previous 2.16.x verions, and CVS upgrade instructions are available at:
>   http://www.bugzilla.org/download.html
> 
> Specific patches for each of the individual issues can be found on the
> corresponding bug reports for each issue, at the URL given in the
> reference for that issue in the list above.
> 
> 
> Credits
> =======
> 
> The Bugzilla team wish to thank the following people for their
> assistance in locating and advising us of these situations:
> 
> Bradley Baetz - for discovering and fixing the issue with voting on a
>     secure bug
> Ryan Cleary - for discovering the issue with component descriptions of
>     secured products
> Andrew Eross - for discovering the SQL injection in collectstats.pl
> Vlad Dascalu - for discovering the SQL injection in editkeywords.cgi
> Stefan Mayr - for discovering and fixing the privilege deletion issue
>     when deleting products
> 
> 
> General information about the Bugzilla bug-tracking system can be found
> at http://www.bugzilla.org/
> 
> Comments and follow-ups can be directed to the
> netscape.public.mozilla.webtools newsgroup or the mozilla-webtools
> mailing list; http://www.bugzilla.org/discussion.html has directions for
> accessing these forums.
> 
> -30-
> -- 
> Dave Miller      Project Leader, Bugzilla Bug Tracking System
> http://www.justdave.net/             http://www.bugzilla.org/
> 
> ----- End forwarded message -----
> 
> -- 
> Seth Alan Woolley <seth at positivism.org>, SPAM/UCE is unauthorized
> Key id EF10E21A = 36AD 8A92 8499 8439 E6A8  3724 D437 AF5D EF10 E21A
> http://smgl.positivism.org:11371/pks/lookup?op=get&search=0xEF10E21A



> _______________________________________________
> SM-Security mailing list
> SM-Security AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-security


-- 
Seth Alan Woolley <seth at positivism.org>, SPAM/UCE is unauthorized
Key id EF10E21A = 36AD 8A92 8499 8439 E6A8  3724 D437 AF5D EF10 E21A
http://smgl.positivism.org:11371/pks/lookup?op=get&search=0xEF10E21A

Attachment: pgpWI0Ys3BwF2.pgp
Description: PGP signature