-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Bugzilla Security Advisory ========================== December 27, 2005 Summary ======= Bugzilla is a Web-based bug-tracking system, used by a large number of software projects. This advisory covers an insecure temporary filename handling issue in versions of Bugzilla prior to 2.16.11 which make use of the shadow database feature. Versions 2.18 and newer are not affected, nor are older installations which do not use the shadow database. Vulnerability Details ===================== Class: Insecure temporary filename handling Impact: Privilege escalation Where: Local system Versions: 2.9 through 2.16.10. Newer versions are not affected. Description: Bugzilla uses a script called syncshadowdb to manually replicate data between a master database and a slave. The script uses temporary files in an unsafe way since it selects a name for the file based on PID and does not make any effort to determine if the file exists and if it is a symlink. A local user could use this to direct symlink attacks and overwrite files that Bugzilla has access to. Reference: https://bugzilla.mozilla.org/show_bug.cgi?id=305353 CVE Name: CVE-2005-4534 Vulnerability Solutions ======================= The fix for this security issue will be included in the upcoming 2.16.11 release of Bugzilla. In the meantime, the patch to fix this issue can be obtained from the URL listed in the reference above. The patch only touches the syncshadowdb file. Please note that Bugzilla version 2.16.* is an older release and very near end-of-life of its security support. Users are advised to upgrade to the latest stable release as soon as possible to continue to receive security support. Credits ======= The Bugzilla team wish to thank the following people for their assistance in locating, advising us of, and assisting us to fix these situations: Javier Fern??ndez-Sanguino Pe??a Teemu Mannermaa General information about the Bugzilla bug-tracking system can be found at http://www.bugzilla.org/ Comments and follow-ups can be directed to the netscape.public.mozilla.webtools newsgroup or the mozilla-webtools mailing list; http://www.bugzilla.org/support/ has directions for accessing these forums. -30- - -- Dave Miller http://www.justdave.net/ System Administrator, Mozilla Corporation http://www.mozilla.com/ Project Leader, Bugzilla Bug Tracking System http://www.bugzilla.org/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFDsik10YeDAOcbS44RAvYVAJ9xDYMFmbHBROQtoeKhGdR5dtQtogCeKSMP 4aHgh2NGh1pAOVSaV/Xdcf4= =FDTk -----END PGP SIGNATURE-----