editproducts.cgi in Bugzilla 2.14.x before 2.14.4, and 2.16.x before 2.16.1, when the "usebuggroups" feature is enabled and more than 47 groups are specified, does not properly calculate bit values for large numbers, which grants extra permissions to users via known features of Perl math that set multiple bits.

The developers of Bugzilla, a web-based bug tracking system, discovered a problem in the handling of more than 47 groups. When a new product is added to an installation with 47 groups or more and 'usebuggroups' is enabled, the new group will be assigned a groupset bit using Perl math that is not exact beyond 248. This results in the new group being defined with a 'bit' that has several bits set. As users are given access to the new group, those users will also gain access to spurious lower group privileges. Also, group bits were not always reused when groups were deleted.

The remote server is running Bugzilla, a bug tracking system. There is a flaw in the remote installation of Bugzilla that may allow an attacker to execute arbitrary code on this host.

According to its version number, the remote Bugzilla bug tracking system is vulnerable to various flaws, including SQL injection, cross-site scripting, and arbitrary command execution.

ID	Name	Product	Family	Severity
15010	Debian DSA-173-1 : bugzilla - privilege escalation	Nessus	Debian Local Security Checks	high
1582	Bugzilla < 2.14.5 / 2.16.2 / 2.17.3 Multiple Vulnerabilities	Nessus Network Monitor	CGI	high
11463	Bugzilla < 2.14.2 / 2.16rc2 / 2.17 Multiple Vulnerabilities (SQLi, XSS, ID, Cmd Exe)	Nessus	CGI abuses	high

Detections

Analytics

CVE-2002-1196

high

Tenable Plugins

high

high

high