Bugzilla cross-site scripting and Security Restriction Bypass Vulnerability

Release date: 2011-12-30
Updated on: 2011-12-31

Affected Systems:
Mozilla Bugzilla 4.x
Mozilla Bugzilla 3.x
Unaffected system:
Mozilla Bugzilla 4.2rc1
Mozilla Bugzilla 4.0.3
Mozilla Bugzilla 3.6.7
Mozilla Bugzilla 3.4.13
Description:
--------------------------------------------------------------------------------
Bugtraq id: 51213
Cve id: CVE-2011-3657, CVE-2011-3667

Bugzilla is an open-source defect tracking system that manages the entire lifecycle of defects in software development, such as submitting, repairing, and disabling defects.

Multiple security vulnerabilities exist in the implementation of Bugzilla. Successful exploitation of these vulnerabilities allows attackers to bypass certain security restrictions, execute arbitrary script code, steal Cookie authentication creden。, and perform certain management operations.

1) because the "User. offer_account_by_email" method does not check the "user_can_create_account" value before sending an email to an account, you can create a User account;

2) the input to the chart is not properly filtered before being returned to the user. the content of the "label0" parameter of cgi (when "debug" is set to "1") can be used to execute arbitrary HTML and script code;

3) when changing the Real Name, some inputs passed to report. cgi are used if they are not properly filtered. Attackers can insert arbitrary HTML and script code, and then execute the code in the user's browser of the affected site when viewing malicious data.

<* Source: Byron Jones

Link: http://secunia.com/advisories/47365/
Http://secunia.com/advisories/47369/
Https://bugzilla.mozilla.org/show_bug.cgi? Id = 711714
Https://bugzilla.mozilla.org/show_bug.cgi? Id = 697699
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Mozilla
-------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.mozilla.org/security/