389843 - Security Advisory for 2.20.5, 2.22.3, 3.0.1, and 3.1.1

Status: RESOLVED FIXED

(Bugzilla :: bugzilla.org, defect)

Description

[Frédéric Buclin]

3 security bugs will be fixed. We need a sec adv for them.

Comment 1

[Frédéric Buclin]

Attachment: Sec Adv, v1

I'm not quite sure about the 2nd issue, especially its class and the kind of damage it can do.

Comment 2

[Max Kanat-Alexander]

Comment on attachment 276935 [details]
Sec Adv, v1

>+ Users using the WebService interface may access time-related data they
>  are not allowed to read.

  Let's make that:

  Users using the WebService interface may access Bugzilla's time-tracking fields even if they normally cannot see them.

>Description: Bugzilla does not properly escape the 'buildid' field in
>             the guided form when filing bugs. From 2.17.1 till 2.23.3,
>             this field was based exclusively on the User-Agent string
>             returned by your web browser, which may be considered as
>             safe or not.

  Don't put "which may be considered as safe or not"--security folks will be unhappy with that, as it's never safe.

> Since 2.23.4, this parameter can be defined
>             in the URL passed to enter_bug.cgi, overwriting the
>             User-Agent string and may lead to cross-site scripting.

  Mention also:

  The guided form is not usually used by Bugzilla installations, as it is shipped only as an example to be modified for their own use.


>Issue 2
>-------
>Class:       Manipulation Of Data

  "Command Injection" I believe.

>Versions:    2.23.4 and above
>Description: Bugzilla 2.23.4 and newer use the Email:: modules instead
>             of the Mail:: and MIME:: ones. The argument passed to the -f
>             option of Email::Send::Sendmail() is insufficiently escaped
>             and may lead to arbitrary code execution

  "limited command injection" instead of "arbitrary code execution". (The commands you can run are very limited, but you can still run commands.)

> when called from
>             email_in.pl, a script which has also been introduced in 2.23.4.

  "was" instead of "has also been".

>Description: WebService allows you to get data from a Bugzilla installation
>             using XML-RPC. Time-related data of bugs are returned in all
>             cases, even when the user asking for these data does not have
>             the required privileges.

  "Bugzilla's WebService (XML-RPC) interface allows you to access the time-tracking fields (such as Deadline, Estimated Time, etc.) on all bugs, even if you normally cannot access time-tracking fields."

>Full release downloads, patches to upgrade Bugzilla from previous
>versions, and CVS upgrade instructions are available at:
>
>  http://www.bugzilla.org/download.html

  http://www.bugzilla.org/download/

  Otherwise, looks great! :-) Thank you!

Comment 3

[Frédéric Buclin]

Attachment: Sec Adv, v2

Comment 4

[Max Kanat-Alexander]

Comment on attachment 277027 [details]
Sec Adv, v2

Looks great! Thanks! :-)

Comment 5

[Max Kanat-Alexander]

Okay, sent to support-bugzilla, announce@, and BugTraq.