lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 3 Nov 2003 00:13:39 -0500
From: David Miller <>
Subject: [BUGZILLA] Security Advisory - SQL injection, information leak

Bugzilla Security Advisory

November 2, 2003


Bugzilla is a Web-based bug-tracking system, currently used by a large
number of software projects.

This advisory covers security bugs that have recently been discovered
and fixed in the Bugzilla code: two instances of arbitrary SQL injection
exploitable only by a privileged user, one instance where a privileged
user may retain privileges that should have been removed, and two
instances of unprivileged access to summaries of restricted data.

These bugs are not considered critical, since their impact is quite
limited. Nevertheless, all Bugzilla installations are advised to upgrade
to the latest stable version of Bugzilla, 2.16.4, which was released

Development snapshots prior to version 2.17.5 are also affected, so if
you are using a development snapshot, you should obtain a newer one
(2.17.5) or use CVS to update.

Vulnerability Details

Issue 1
Class:       SQL injection (by privileged user only)
Versions:    2.16.3 and earlier (2.17.1 and up are not affected)
Description: A user with 'editproducts' privileges (i.e. usually an
             administrator) can select arbitrary SQL to be run by the
             nightly statistics cron job (, by giving a
             product a special name.

Issue 2
Class:       SQL injection (by privileged user only)
Versions:    2.16.3 and earlier, 2.17.1 through 2.17.4
Description: A user with 'editkeywords' privileges (i.e. usually an
             administrator) can inject arbitrary SQL via the URL used to
             edit an existing keyword.

Issue 3
Class:       Privilege mishandling
Versions:    2.16.3 and earlier (2.17.1 and up are not affected)
Description: When deleting products and the 'usebuggroups' parameter is
             on, the privilege which allows someone to add people to the
             group which is being deleted does not get removed, allowing
             people with that privilege to get that privilege for the
             next group that is created which reuses that group ID.
             Note that this only allows someone who had been granted
             privileges in the past to retain them.

Issue 4
Class:       Information leak
Versions:    2.16.3 and earlier, 2.17.1 through 2.17.4
Description: If you know the email address of someone who has voted on a
             secure bug, you can access the summary of that bug even if
             you do not have sufficient permissions to view the bug

Issue 5
Class:       Information leak
Versions:    2.17.3 and 2.17.4 only
Description: Under some circumstances, a user can obtain component
             descriptions for a product to which he does not normally
             have access.

Vulnerability Solutions

The fixes for all of the security bugs mentioned in this advisory
are included in the 2.16.4 and 2.17.5 releases.  Upgrading to these
releases will protect installations from these issues.

Full release downloads, patches to upgrade Bugzilla to 2.16.4 from
previous 2.16.x verions, and CVS upgrade instructions are available at:

Specific patches for each of the individual issues can be found on the
corresponding bug reports for each issue, at the URL given in the
reference for that issue in the list above.


The Bugzilla team wish to thank the following people for their
assistance in locating and advising us of these situations:

Bradley Baetz - for discovering and fixing the issue with voting on a
    secure bug
Ryan Cleary - for discovering the issue with component descriptions of
    secured products
Andrew Eross - for discovering the SQL injection in
Vlad Dascalu - for discovering the SQL injection in editkeywords.cgi
Stefan Mayr - for discovering and fixing the privilege deletion issue
    when deleting products

General information about the Bugzilla bug-tracking system can be found

Comments and follow-ups can be directed to the
netscape.public.mozilla.webtools newsgroup or the mozilla-webtools
mailing list; has directions for
accessing these forums.

Dave Miller      Project Leader, Bugzilla Bug Tracking System   

Powered by blists - more mailing lists