620540 - Security Advisory for Bugzilla 4.0rc2, 3.6.4, 3.4.10 and 3.2.10

Status: RESOLVED FIXED

(Bugzilla :: bugzilla.org, defect)

Description

[Frédéric Buclin]

We have several moderate to critical security bugs to fix for 4.0rc2 & co. I also include the CGI.pm one, hoping a new version will be released on time on CPAN.

CVE ref welcome.

Comment 2

[Max Kanat-Alexander]

Attachment: v1

Comment 3

[Reed Loden [:reed]]

Comment on attachment 506051 [details]
v1

>Bugzilla is a Web-based bug-tracking system used by a large number of
>software projects. Recently, the Mozilla Project offered a bounty to
>anyone who could find a security issue in systems that Mozilla uses.
>
>This resulted in several new security issues being found in Bugzilla:

""
Recently, Mozilla expanded its security bug bounty program to include web applications (http://www.mozilla.org/security/bug-bounty.html).

As a result, several new security issues affecting Bugzilla were reported:
OR
This expansion resulted in the finding of several new security issues affecting Bugzilla:
""

The bounty program isn't new, so should clarify that only the webapp part is recent. Also, I added a link to the program. It couldn't hurt, and we might get more submissions that way. I think we should add a shout-out to Mozilla for offering this program, either before the vulnerability details or towards the end. We could move the link there if it's too prominent in the intro.

>* A weakness in Bugzilla could allow a user to gain unauthorized access
>  to another Bugzilla account.

Any reason why you're using "could allow" here when you use "allows" or more present/active verbs later on in the list?

>* A weakness in the Perl CGI.pm module allows injecting HTTP headers
>  and content to users, on several pages in Bugzilla.

s/users, on/users via/

>* Normally, Bugzilla does not make "javascript:" or "data:" URLs into
>  clickable links if they are put into the "URL" field, but there is
>  a way to bypass that protection.

This one doesn't flow. Need to restructure to match format of other issues. Maybe something starting like this:
A weakness in Bugzilla's protection against clickable "javascript:" or "data:" URLs allows ....

>* Various pages lacks protection against cross-site request forgeries.

s/lacks/lack/

>Description: By inserting certain strings into certain URLs, it was 
>             possible to inject both headers and content to any 
>             browser.

Got another word besides "certain" so you're not using it twice?

s/to any/into any/

>References:  https://bugzilla.mozilla.org/show_bug.cgi?id=591165
>             http://avatraxiom.livejournal.com/104105.html
>             http://cwe.mitre.org/data/definitions/113.html

Add https://bugzilla.mozilla.org/show_bug.cgi?id=621572.

>CVE Number:  CVE-2010-2761, CVE-2010-4572, CVE-2010-4411

List in numerical order (also since 2761 and 4411 go together).

>Description: Bugzilla 3.7.x and 4.0rc1 have a new client-side
>             autocomplete mechanism for all fields where a username
>             is entered. This mechanism was vulnerable to a cross-site
>             scripting attack.

s/a username/an e-mail address/

>CVS Number:  CVE-2010-4569

s/CVS/CVE/

>Description: Bugzilla has a "URL" field that can contain any type
>             of URL, including "javascript:" and "data:" URLs. However,
>             it does not make "javascript:" and "data:" URLs into
>             clickable links, to protect against cross-site scripting
>             attacks or other attacks. It was possible to bypass this
>             protection by adding spaces into the URL in places that
>             Bugzilla did not expect them.

s/any type/several types/

>Description: Various pages were vulnerable to non-critical Cross-Site
>             Request Forgery attacks. Some of these issues were only

Drop the "non-critical", as some do concern dataloss and such.

>             addressed on more recent branches of Bugzilla and not
>             fixed in earlier branches, to avoid changing behavior
>             that external applications may depend on.

... fixed in older branches in order to avoid changing ...

>References:  https://bugzilla.mozilla.org/show_bug.cgi?id=621090
>             https://bugzilla.mozilla.org/show_bug.cgi?id=621105
>             https://bugzilla.mozilla.org/show_bug.cgi?id=621107
>             https://bugzilla.mozilla.org/show_bug.cgi?id=621108
>             https://bugzilla.mozilla.org/show_bug.cgi?id=621109
>             https://bugzilla.mozilla.org/show_bug.cgi?id=621110

dveditz, do we need one CVE for all of these or one per issue?

>Willem Pinckaers of Pine Security (reporter, Account Compromise issue)

Pine Digital Security

>Alex Miller

Replace with [e-mail] (real name unknown). Alex was not the original reporter. If there are questions about this, poke me on IRC (not here).

>Comments and follow-ups can be directed to the mozilla.support.bugzilla
>newsgroup or the support-bugzilla mailing list.
>http://www.bugzilla.org/support/ has directions for accessing these
>forums.

You know, we don't actually have a place (that I can find) explaining how to report security bugs. We should either add a blurb here at the bottom or include something on the /support/ page.

Comment 4

[Daniel Veditz [:dveditz]]

(In reply to comment #3)
> >References:  https://bugzilla.mozilla.org/show_bug.cgi?id=621090
> >             https://bugzilla.mozilla.org/show_bug.cgi?id=621105
> >             https://bugzilla.mozilla.org/show_bug.cgi?id=621107
> >             https://bugzilla.mozilla.org/show_bug.cgi?id=621108
> >             https://bugzilla.mozilla.org/show_bug.cgi?id=621109
> >             https://bugzilla.mozilla.org/show_bug.cgi?id=621110
> 
> dveditz, do we need one CVE for all of these or one per issue?

Looks like Jose A. Vazquez reported one and then you investigated and looked for other places with the same pattern/problem? If so a single CVE is appropriate.

Comment 5

[Frédéric Buclin]

/me will wait for an updated sec adv before reviewing it.

Comment 6

[Reed Loden [:reed]]

(In reply to comment #4)
> > dveditz, do we need one CVE for all of these or one per issue?
> 
> Looks like Jose A. Vazquez reported one and then you investigated and looked
> for other places with the same pattern/problem? If so a single CVE is
> appropriate.

Correct. Please assign one then. :)

Comment 7

[Reed Loden [:reed]]

Also need to add bug 628034 to the advisory.

Comment 8

[Reed Loden [:reed]]

(In reply to comment #7)
> Also need to add bug 628034 to the advisory.

... and add Mike Brooks to the credits, as the reporter.

Comment 9

[Reed Loden [:reed]]

(In reply to comment #8)
> (In reply to comment #7)
> > Also need to add bug 628034 to the advisory.
> 
> ... and add Mike Brooks to the credits, as the reporter.

Make that: Michael Brooks (Sitewatch).

Comment 10

[Max Kanat-Alexander]

Attachment: v2

Okay, addressed almost everything that reed pointed out.

Comment 11

[Reed Loden [:reed]]

Comment on attachment 506330 [details]
v2

>References:  https://bugzilla.mozilla.org/show_bug.cgi?id=619588
>             https://bugzilla.mozilla.org/show_bug.cgi?id=628034
>CVE Number:  CVE-2010-4567

Add CVE-2011-0048 to the list.

>References:  https://bugzilla.mozilla.org/show_bug.cgi?id=621090
>             https://bugzilla.mozilla.org/show_bug.cgi?id=621105
>             https://bugzilla.mozilla.org/show_bug.cgi?id=621107
>             https://bugzilla.mozilla.org/show_bug.cgi?id=621108
>             https://bugzilla.mozilla.org/show_bug.cgi?id=621109
>             https://bugzilla.mozilla.org/show_bug.cgi?id=621110

CVE-2011-0046

>Willem Pinckaers of pine.nl (reporter, Account Compromise issue)

Pine Digital Security, if you can...

>Michael Brooks

List as: Michael Brooks of Sitewatch

>Jose A. Vazquez

José A. Vázquez (I know his bugzilla account says differently, but this comes from e-mail)

Comment 12

[Max Kanat-Alexander]

Attachment: v3

Comment 13

[Reed Loden [:reed]]

Comment on attachment 506489 [details] [diff] [review]
v3

>Class:       HTTP Response Splitting
>Versions:    Every Version Before 3.2.10, 3.4.10, 3.6.4, 4.0rc2
>Fixed In:    3.2.10, 3.4.10, 3.6.4, 4.0rc2
>Description: By inserting particular strings into certain URLs, it was
>             possible to inject both headers and content to any 
>             browser.
>References:  https://bugzilla.mozilla.org/show_bug.cgi?id=591165
>             http://avatraxiom.livejournal.com/104105.html
>             http://cwe.mitre.org/data/definitions/113.html

Add https://bugzilla.mozilla.org/show_bug.cgi?id=621572.

>Dave Lawrence

David, as per IRC.

r=reed with those fixed.

Comment 14

[Reed Loden [:reed]]

Comment on attachment 506489 [details] [diff] [review]
v3

>* A weakness in Bugzilla could allow a user to gain unauthorized access
>  to another Bugzilla account.

Any reason why you're using "could allow" here when you use "allows" or more present/active verbs later on in the list?

>Class:       Cross-Site Request Forgery
>Versions:    Every Version Before 3.2.10, 3.4.10, 3.6.4, 4.0rc2
>Fixed In:    3.2.10, 3.4.10, 3.6.4, 4.0rc2
>Description: Various pages were vulnerable to Cross-Site Request 
>             Forgery attacks. Most of these issues are not as serious
>             as previous CSRF vulnerabilities. Some of these issues
>             were only addressed on more recent branches of Bugzilla
>             and not fixed in earlier branches, to avoid changing
>             behavior that external applications may depend on.

s/, to/in order to/

Comment 15

[Max Kanat-Alexander]

(In reply to comment #14)
> Any reason why you're using "could allow" here when you use "allows" or more
> present/active verbs later on in the list?

  I felt it was more accurate.

> s/, to/in order to/

  Will fix.

Comment 16

[Max Kanat-Alexander]

Attachment: v4

Comment 17

[Reed Loden [:reed]]

Comment on attachment 506528 [details] [diff] [review]
v4

>References:  https://bugzilla.mozilla.org/show_bug.cgi?id=591165
>              https://bugzilla.mozilla.org/show_bug.cgi?id=621572

Remove extra space.

r=reed with that fixed.

Comment 18

[Frédéric Buclin]

Comment on attachment 506528 [details] [diff] [review]
v4

>Willem Pinckaers of pine.nl (reporter, Account Compromise issue)

We want a "special thanks" section for Willem, as discussed on IRC.

Comment 19

[Max Kanat-Alexander]

Attachment: v5

Comment 20

[Frédéric Buclin]

Comment on attachment 506545 [details] [diff] [review]
v5

nice, thanks! r=LpSolit

Comment 21

[Reed Loden [:reed]]

Comment on attachment 506545 [details] [diff] [review]
v5

>Full release downloads, patches to upgrade Bugzilla from previous
>versions, and CVS/bzr upgrade instructions are available at:
>
>  http://www.bugzilla.org/download/
>
>
>Credits
>=======

Remove the extra line.

>Willem Pinckaers

Willem Pinckaers (Pine Digital Security)

Comment 22

[Frédéric Buclin]

(In reply to comment #21)
> >Willem Pinckaers
> 
> Willem Pinckaers (Pine Digital Security)

No, this is already in the section below

Comment 23

[Reed Loden [:reed]]

Comment on attachment 506545 [details] [diff] [review]
v5

(In reply to comment #22)
> (In reply to comment #21)
> > >Willem Pinckaers
> > 
> > Willem Pinckaers (Pine Digital Security)
> 
> No, this is already in the section below

No, should also list it in the credits section. Believe me, it's better to duplicate it than upset somebody down the road. I've been down this road before. ;)

Comment 24

[Frédéric Buclin]

Security advisory sent. Removing the security flag.