Release Date: 2003-11-05
Critical: Moderately critical
Impact: Security Bypass
Manipulation of data
Exposure of sensitive information
Privilege escalation
Where: From remote
Software: Bugzilla 2.x
Description:
Multiple vulnerabilities have been identified in Bugzilla allowing malicious users to inject SQL or view sensitive information.
1) The "editproducts" parameter isn't properly verified allowing malicious users to supply arbitrary SQL queries. The SQL queries will be executed by the cron job "collectstat.pl".
2) The "editkeywords" parameter isn't properly verified allowing malicious users to supply arbitrary SQL queries.
3) Bug group memberships aren't properly deleted when a group is deleted. This allows previous members of that group to conduct administrative functions when a new group with the same ID is created.
4) It is possible to view the summary of a "secure" bug if an email address is supplied, which previously has been used to vote on the bug.
5) An unspecified vulnerability may allow users to view component descriptions for a product, which the user doesn't have access to.
The vulnerabilities have been reported in various versions prior to 2.17.5 and 2.16.4.
Solution:
Versions 2.17.5 and 2.16.4 are not vulnerable.
www.bugzilla.org/download.html
Reported by / credits:
Andrew Eross
Vlad Dascalu
Stefan Mayr
Bradley Baetz
Ryan Cleary
Original Advisory:
http://bugzilla.mozilla.org/show_bug.cgi?id=214290
http://bugzilla.mozilla.org/show_bug.cgi?id=219044
http://bugzilla.mozilla.org/show_bug.cgi?id=219690
http://bugzilla.mozilla.org/show_bug.cgi?id=209376
http://bugzilla.mozilla.org/show_bug.cgi?id=209742
Source: Secunia