FreeBSD : bugzilla -- multiple vulnerabilities (309542b5-50b9-11e1-b0d8-00151735203a)

Medium Nessus Plugin ID 57852


The remote FreeBSD host is missing one or more security-related updates.


A Bugzilla Security Advisory reports :

The following security issues have been discovered in Bugzilla :

- Account Impersonation : When a user creates a new account, Bugzilla doesn't correctly reject email addresses containing non-ASCII characters, which could be used to impersonate another user account.
Such email addresses could look visually identical to other valid email addresses, and an attacker could try to confuse other users and be added to bugs he shouldn't have access to.

- Cross-Site Request Forgery : Due to a lack of validation of the Content-Type head when making POST requests to jsonrpc.cgi, a possible CSRF vulnerability was discovered. If a user visits an HTML page with some malicious JS code in it, an attacker could make changes to a remote Bugzilla installation on behalf of the victim's account by using the JSON-RPC API. The user would have had to be already logged in to the target site for the vulnerability to work.

All affected installations are encouraged to upgrade as soon as possible.


Update the affected packages.

See Also

Plugin Details

Severity: Medium

ID: 57852

File Name: freebsd_pkg_309542b550b911e1b0d800151735203a.nasl

Version: $Revision: 1.5 $

Type: local

Published: 2012/02/07

Modified: 2015/05/13

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 5.1

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:bugzilla, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 2012/02/06

Vulnerability Publication Date: 2012/01/31

Reference Information

CVE: CVE-2012-0440, CVE-2012-0448