Bugzilla before 4.0.16, 4.1.x and 4.2.x before 4.2.12, 4.3.x and 4.4.x before 4.4.7, and 5.x before 5.0rc1 allows remote authenticated users to execute arbitrary commands by leveraging the editcomponents privilege and triggering crafted input to a two-argument Perl open call, as demonstrated by shell metacharacters in a product name.

The remote host is affected by the vulnerability described in GLSA-201607-11 (Bugzilla: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Bugzilla. Please review       the CVE identifiers referenced below for details.
  Impact :

    Privileged account holders could execute system level commands, and the       new user process could be exploited to allow for the escalation of       privileges.
  Workaround :

    There is no known workaround at this time.

The remote host is running Bugzilla, a bug tracking software with a web interface. All versions of Bugzilla prior to 4.0.16, 4.1.1 prior to 4.2.11, 4.3.1 prior to 4.4.6, and 4.5.1 prior to 4.5.6 are susceptible to a command injection vulnerability. This vulnerability exists due to a flaw which fails to properly utilize the three arguments form of the Perl 'open()' function. An attacker can exploit this issue by injecting commands into product names and other attributes. Successfully exploiting this issue may allow an attacker to execute arbitrary commands in the context of the affected application.
Note : To exploit this issue an attacker must have an account with 'editcomponents' permission.

According to its banner, the version of Bugzilla running on the remote host is potentially affected by the following vulnerabilities :

  - A command injection vulnerability exists due to a     failure to properly utilize the 3 arguments form for     open(). This allows an authenticated, remote attacker     with 'editcomponents' permission, to inject commands     into attributes. (CVE-2014-8630)

  - An information disclosure vulnerability exists in the     WebServices API. An attacker can execute imported     functions from non-WebServices modules.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This is a security update for Bugzilla which fixes two issues :

  - A user with editcomponents permissions could possibly     inject system commands in product names and possibly     other attributes.

  - Methods from imported modules could possibly be executed     using the WebService API.

The first issue is tracked as CVE-2014-8630. See https://www.bugzilla.org/security/4.0.15/ for all the details.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated bugzilla packages fix security vulnerability :

Some code in Bugzilla does not properly utilize 3 arguments form for open() and it is possible for an account with editcomponents permissions to inject commands into product names and other attributes (CVE-2014-8630).

Bugzilla Security Advisory Command Injection Some code in Bugzilla does not properly utilize 3 arguments form for open() and it is possible for an account with editcomponents permissions to inject commands into product names and other attributes. Information Leak Using the WebServices API, a user can possibly execute imported functions from other non-WebService modules. A whitelist has now been added that lists explicit methods that can be executed via the API.

ID	Name	Product	Family	Severity
92481	GLSA-201607-11 : Bugzilla: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
8913	Bugzilla < 4.0.16 / 4.1.1 < 4.2.12 / 4.3 < 4.4.7 / 4.5 < 4.5.6 Command Injection	Nessus Network Monitor	CGI	medium
81424	Bugzilla < 4.0.16 / 4.2.12 / 4.4.7 / 5.0rc1 Multiple Vulnerabilities	Nessus	CGI abuses	medium
81356	Fedora 21 : bugzilla-4.4.8-1.fc21.1 (2015-1713)	Nessus	Fedora Local Security Checks	medium
81353	Fedora 20 : bugzilla-4.2.13-1.fc20 (2015-1699)	Nessus	Fedora Local Security Checks	medium
81196	Mandriva Linux Security Advisory : bugzilla (MDVSA-2015:030)	Nessus	Mandriva Local Security Checks	medium
81010	FreeBSD : Bugzilla multiple security issues (dc2d76df-a595-11e4-9363-20cf30e32f6d)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2014-8630

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium