674497 - (CVE-2011-2979) [SECURITY] Custom searches let you determine if a group exists or not

Status: RESOLVED FIXED

(Bugzilla :: Query/Bug List, defect)

Description

[Frédéric Buclin]

Regression due to bug 574556, i.e. since Bugzilla 4.1.1:

Run the two queries below:

1) Assignee is equal to %group.foo%
2) Assignee is equal to %group.canconfirm%

In Bugzilla 4.0.x and below, you get the same error message, independently of whether the group exists or not, to not leak this information, see bug 417048. But this regressed again in 4.1.1 as ValidateGroupName() has been replaced by Bugzilla::Group->check(), which throws an explicit error message if the group doesn't exist.

Comment 1

[Frédéric Buclin]

Attachment: patch, v1

Override the error message to match what happens when the user is not in the group, so that the error message is exactly the same in both cases.

Comment 2

[:glob ✱]

Comment on attachment 548748 [details] [diff] [review]
patch, v1

r=glob

Comment 3

[Frédéric Buclin]

We didn't branch yet. :)

Comment 4

[Daniel Veditz [:dveditz]]

Use CVE-2011-2979 for this bug

Comment 5

[Max Kanat-Alexander]

Comment on attachment 548748 [details] [diff] [review]
patch, v1

Review of attachment 548748 [details] [diff] [review]:
-----------------------------------------------------------------

::: Bugzilla/Search.pm
@@ +2007,4 @@
>      my $user = $self->_user;
>      
>      $value =~ /\%group\.([^%]+)%/;
> +    my $group = Bugzilla::Group->check({ name => $1, _error => 'invalid_group_name' });

Ah, we should have Bugzilla::Group->check_carefully. Could somebody please implement that?

Comment 6

[Frédéric Buclin]

(In reply to comment #5)
> Ah, we should have Bugzilla::Group->check_carefully. Could somebody please
> implement that?

Not as part of this bug, no. :)

Comment 7

[Frédéric Buclin]

Committing to: bzr+ssh://[e-mail]/bugzilla/trunk/
modified Bugzilla/Search.pm
Committed revision 7892.

Comment 8

[Max Kanat-Alexander]

Security advisory sent, unlocking this bug.