Util.pm in Bugzilla 2.x, 3.x, and 4.x before 4.2.15, 4.3.x and 4.4.x before 4.4.10, and 5.x before 5.0.1 mishandles long e-mail addresses during account registration, which allows remote attackers to obtain the default privileges for an arbitrary domain name by placing that name in a substring of an address, as demonstrated by truncation of an @mozilla.com.example.com address to an @mozilla.com address.

According to its banner, the version of Bugzilla running on the remote host falls within the range of 2.0 prior to 4.2.15, 4.3.1 prior to 4.4.10, or 4.5.1 prior to 5.0.1. Such versions are affected by an account creation bug that causes input passed via the 'login' parameter to be truncated, resulting in domain names of email addresses becoming corrupted. An unauthenticated, remote attacker can exploit this to create accounts with email addresses that differ from the original requests.

Security fix for CVE-2015-4499 A security problem was found in supported versions of Bugzilla. Login names longer than 127 characters can be corrupted, which could lead to the creation of a user account with an unexpected email address. Bugzilla 4.4.10 fixes the issue for the 4.4 branch of Bugzilla.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of Bugzilla running on the remote host contains a flaw that causes input passed via the 'login' parameter to be truncated, resulting in domain names of email addresses becoming corrupted. An unauthenticated, remote attacker can exploit this to create accounts with email accounts that differ from the original requests.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Bugzilla Security Advisory

Login names (usually an email address) longer than 127 characters are silently truncated in MySQL which could cause the domain name of the email address to be corrupted. An attacker could use this vulnerability to create an account with an email address different from the one originally requested. The login name could then be automatically added to groups based on the group's regular expression setting.

ID	Name	Product	Family	Severity
9268	Bugzilla 2.0 < 4.2.15 / 4.3.1 < 4.4.10 / 4.5.1 < 5.0.1 Unauthorized Account Creation Vulnerability	Nessus Network Monitor	CGI	medium
86644	Fedora 21 : bugzilla-4.4.10-1.fc21 (2015-15768)	Nessus	Fedora Local Security Checks	high
86643	Fedora 22 : bugzilla-4.4.10-1.fc22 (2015-15767)	Nessus	Fedora Local Security Checks	high
86273	Fedora 23 : bugzilla-4.4.10-1.fc23 (2015-15769)	Nessus	Fedora Local Security Checks	high
86048	Bugzilla < 4.2.15 / 4.4.10 / 5.0.1 Unauthorized Account Creation Vulnerability	Nessus	CGI abuses	high
85925	FreeBSD : Bugzilla security issues (ea893f06-5a92-11e5-98c0-20cf30e32f6d)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2015-4499

critical

Tenable Plugins

medium

high

high

high

high

high