The WebService (XML-RPC) interface in Bugzilla 2.23.3 through 3.0.0 does not enforce permissions for the time-tracking fields of bugs, which allows remote attackers to obtain sensitive information via certain XML-RPC requests, as demonstrated by the (1) Deadline and (2) Estimated Time fields.

The remote host is affected by the vulnerability described in GLSA-200709-18 (Bugzilla: Multiple vulnerabilities)

    Masahiro Yamada found that from the 2.17.1 version, Bugzilla does not     properly sanitize the content of the 'buildid' parameter when filing     bugs (CVE-2007-4543). The next two vulnerabilities only affect Bugzilla     2.23.3 or later, hence the stable Gentoo Portage tree does not contain     these two vulnerabilities: Loic Minier reported that the     'Email::Send::Sendmail()' function does not properly sanitise 'from'     email information before sending it to the '-f' parameter of     /usr/sbin/sendmail (CVE-2007-4538), and Frederic Buclin discovered that     the XML-RPC interface does not correctly check permissions in the     time-tracking fields (CVE-2007-4539).
  Impact :

    A remote attacker could trigger the 'buildid' vulnerability by sending     a specially crafted form to Bugzilla, leading to a persistent XSS, thus     allowing for theft of credentials. With Bugzilla 2.23.3 or later, an     attacker could also execute arbitrary code with the permissions of the     web server by injecting a specially crafted 'from' email address and     gain access to normally restricted time-tracking information through     the XML-RPC service.
  Workaround :

    There is no known workaround at this time.

A Bugzilla Security Advisory reports :

This advisory covers three security issues that have recently been fixed in the Bugzilla code :

- A possible cross-site scripting (XSS) vulnerability when filing bugs using the guided form.

- When using email_in.pl, insufficiently escaped data may be passed to sendmail.

- Users using the WebService interface may access Bugzilla's time-tracking fields even if they normally cannot see them.

We strongly advise that 2.20.x and 2.22.x users should upgrade to 2.20.5 and 2.22.3 respectively. 3.0 users, and users of 2.18.x or below, should upgrade to 3.0.1.

he remote host is running Bugzilla, a bug-tracking software with a web interface.  The version of Bugzilla on the remote host suffers from multiple flaws.  An attacker exploiting these flaws would be able to inject HTML, execute arbitrary remote commands and disclose sensitive information.

ID	Name	Product	Family	Severity
26216	GLSA-200709-18 : Bugzilla: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
26090	FreeBSD : bugzilla -- multiple vulnerabilities (75231c63-f6a2-499d-8e27-787773bda284)	Nessus	FreeBSD Local Security Checks	medium
4191	Bugzilla Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium

Detections

Analytics

CVE-2007-4539

high

Tenable Plugins

medium

medium

medium