GLSA-200709-18 : Bugzilla: Multiple vulnerabilities

medium Nessus Plugin ID 26216

Synopsis

The remote Gentoo host is missing one or more security-related patches.

Description

The remote host is affected by the vulnerability described in GLSA-200709-18 (Bugzilla: Multiple vulnerabilities)

Masahiro Yamada found that from the 2.17.1 version, Bugzilla does not properly sanitize the content of the 'buildid' parameter when filing bugs (CVE-2007-4543). The next two vulnerabilities only affect Bugzilla 2.23.3 or later, hence the stable Gentoo Portage tree does not contain these two vulnerabilities: Loic Minier reported that the 'Email::Send::Sendmail()' function does not properly sanitise 'from' email information before sending it to the '-f' parameter of /usr/sbin/sendmail (CVE-2007-4538), and Frederic Buclin discovered that the XML-RPC interface does not correctly check permissions in the time-tracking fields (CVE-2007-4539).
Impact :

A remote attacker could trigger the 'buildid' vulnerability by sending a specially crafted form to Bugzilla, leading to a persistent XSS, thus allowing for theft of credentials. With Bugzilla 2.23.3 or later, an attacker could also execute arbitrary code with the permissions of the web server by injecting a specially crafted 'from' email address and gain access to normally restricted time-tracking information through the XML-RPC service.
Workaround :

There is no known workaround at this time.

Solution

All Bugzilla users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose www-apps/bugzilla

Plugin Details

Severity: Medium

ID: 26216

File Name: gentoo_GLSA-200709-18.nasl

Version: 1.17

Type: local

Family: Gentoo Local Security Checks

Published: 10/3/2007

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

Vulnerability Information

CPE: p-cpe:/a:gentoo:linux:bugzilla, cpe:/o:gentoo:linux

Required KB Items: Host/local_checks_enabled, Host/Gentoo/release, Host/Gentoo/qpkg-list

Patch Publication Date: 9/30/2007

Vulnerability Publication Date: 8/24/2007

Reference Information

CVE: CVE-2007-4538, CVE-2007-4539, CVE-2007-4543

CWE: 264, 79

GLSA: 200709-18

Detections

Analytics