The confirm_create_account function in the account-creation feature in token.cgi in Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 does not specify a scalar context for the realname parameter, which allows remote attackers to create accounts with unverified e-mail addresses by sending three realname values with realname=login_name as the second, as demonstrated by selecting an e-mail address with a domain name for which group privileges are automatically granted.

The remote host is affected by the vulnerability described in GLSA-201607-11 (Bugzilla: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Bugzilla. Please review       the CVE identifiers referenced below for details.
  Impact :

    Privileged account holders could execute system level commands, and the       new user process could be exploited to allow for the escalation of       privileges.
  Workaround :

    There is no known workaround at this time.

The remote host is running Bugzilla, a bug-tracking software with a web interface.  The version of Bugzilla on the remote host is susceptible to the following vulnerabilities :

  - A security-bypass vulnerability because it fails to verify the email id during account creation. Specifically, this issue occurs because the login names are automatically added to groups based on the domain. This issue affects the 'realname' parameter.(CVE-2014-1572)

  - Multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input submitted to CGI arguments.(CVE-2014-1573)

  - An information disclosure vulnerability because a flag mail recipient who is not in an insider group can view the private comments.(CVE-2014-1571)

Security fix for CVE-2014-1571, CVE-2014-1572, CVE-2014-1573

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated bugzilla packages fix security vulnerabilities :

If a new comment was marked private to the insider group, and a flag was set in the same transaction, the comment would be visible to flag recipients even if they were not in the insider group (CVE-2014-1571).

An attacker creating a new Bugzilla account can override certain parameters when finalizing the account creation that can lead to the user being created with a different email address than originally requested. The overridden login name could be automatically added to groups based on the group's regular expression setting (CVE-2014-1572).

During an audit of the Bugzilla code base, several places were found where cross-site scripting exploits could occur which could allow an attacker to access sensitive information (CVE-2014-1573).

Bugzilla Security Advisory Unauthorized Account Creation An attacker creating a new Bugzilla account can override certain parameters when finalizing the account creation that can lead to the user being created with a different email address than originally requested. The overridden login name could be automatically added to groups based on the group's regular expression setting. Cross-Site Scripting During an audit of the Bugzilla code base, several places were found where cross-site scripting exploits could occur which could allow an attacker to access sensitive information. Information Leak If a new comment was marked private to the insider group, and a flag was set in the same transaction, the comment would be visible to flag recipients even if they were not in the insider group. Social Engineering Search results can be exported as a CSV file which can then be imported into external spreadsheet programs. Specially formatted field values can be interpreted as formulas which can be executed and used to attack a user's computer.

According to its banner, the version of Bugzilla installed on the remote host contains multiple flaws. It is, therefore, affected by the following vulnerabilities :

  - If a new comment is marked as private to the insider     group, and a flag is set in the same transaction, the     comment will be visible to flag recipients even if they     are not in the insider group. (CVE-2014-1571)

  - A remote attacker can override certain parameters when     creating a new Bugzilla account. This can lead to the     account being created with a different email address     than originally requested, allowing a user to be added     to certain groups based on the group's regular     expression setting. This may allow an attacker to     escalate a given user accounts privileges.
    (CVE-2014-1572)

  - A flaw existed in how CGI arguments were handled that     could allow cross-site scripting exploits which an     attacker could use to access sensitive information.
    (CVE-2014-1573)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
92481	GLSA-201607-11 : Bugzilla: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
8606	Bugzilla < 4.0.15 / 4.2.11 / 4.4.6 / 4.5.6 Multiple Vulnerabilities	Nessus Network Monitor	CGI	high
78790	Fedora 21 : bugzilla-4.4.6-1.fc21 (2014-12591)	Nessus	Fedora Local Security Checks	medium
78630	Fedora 19 : bugzilla-4.2.11-1.fc19 (2014-12584)	Nessus	Fedora Local Security Checks	medium
78629	Fedora 20 : bugzilla-4.2.11-1.fc20 (2014-12530)	Nessus	Fedora Local Security Checks	medium
78616	Mandriva Linux Security Advisory : bugzilla (MDVSA-2014:200)	Nessus	Mandriva Local Security Checks	medium
78071	FreeBSD : Bugzilla multiple security issues (b6587341-4d88-11e4-aef9-20cf30e32f6d)	Nessus	FreeBSD Local Security Checks	medium
78069	Bugzilla < 4.0.15 / 4.2.11 / 4.4.6 / 4.5.6 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2014-1572

high

Tenable Plugins

medium

high

medium

medium

medium

medium

medium

medium