Secunia Advisory: SA10149
Release Date: 2003-11-05

Critical: Moderately critical
Impact: Security Bypass
Manipulation of data
Exposure of sensitive information
Privilege escalation
Where: From remote

Software: Bugzilla 2.x


Description:
Multiple vulnerabilities have been identified in Bugzilla allowing malicious users to inject SQL or view sensitive information.

1) The "editproducts" parameter isn't properly verified allowing malicious users to supply arbitrary SQL queries. The SQL queries will be executed by the cron job "collectstat.pl".

2) The "editkeywords" parameter isn't properly verified allowing malicious users to supply arbitrary SQL queries.

3) Bug group memberships aren't properly deleted when a group is deleted. This allows previous members of that group to conduct administrative functions when a new group with the same ID is created.

4) It is possible to view the summary of a "secure" bug if an email address is supplied, which previously has been used to vote on the bug.

5) An unspecified vulnerability may allow users to view component descriptions for a product, which the user doesn't have access to.

The vulnerabilities have been reported in various versions prior to 2.17.5 and 2.16.4.

Solution:
Versions 2.17.5 and 2.16.4 are not vulnerable.
www.bugzilla.org/download.html

Reported by / credits:
Andrew Eross
Vlad Dascalu
Stefan Mayr
Bradley Baetz
Ryan Cleary

Original Advisory:
http://bugzilla.mozilla.org/show_bug.cgi?id=214290
http://bugzilla.mozilla.org/show_bug.cgi?id=219044
http://bugzilla.mozilla.org/show_bug.cgi?id=219690
http://bugzilla.mozilla.org/show_bug.cgi?id=209376
http://bugzilla.mozilla.org/show_bug.cgi?id=209742

Source: Secunia

OS/2-eCS-ArcaOS General News

More in General  

OS/2-eCS-ArcaOS Software News

More in Software  

Latest Forum Posts

WarpStock and OS/2-eCS-ArcaOS Event News

More in Events  

Site News

More in Site News