Bug 853868 - (CVE-2012-3981, CVE-2012-4747) CVE-2012-3981 CVE-2012-4747 bugzilla: LDAP injection and disclosure of sensitive information
CVE-2012-3981 CVE-2012-4747 bugzilla: LDAP injection and disclosure of sensit...
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
impact=low,public=20120830,reported=2...
: Security
Depends On: 853870
Blocks:
  Show dependency treegraph
 
Reported: 2012-09-03 03:46 EDT by Jan Lieskovsky
Modified: 2015-07-31 02:53 EDT (History)
2 users (show)

See Also:
Fixed In Version: bugzilla 4.0.8, bugzilla 4.2.3, bugzilla 4.3.3
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2012-09-03 03:46:29 EDT
1) Common Vulnerabilities and Exposures assigned an identifier CVE-2012-3981 to the following vulnerability:

Auth/Verify/LDAP.pm in Bugzilla 2.x and 3.x before 3.6.11, 3.7.x and 4.0.x before 4.0.8, 4.1.x and 4.2.x before 4.2.3, and 4.3.x before 4.3.3 does not restrict the characters in a username, which might allow remote attackers to inject data into an LDAP directory via a crafted login attempt.

  Upstream advisory:
  [1] http://www.bugzilla.org/security/3.6.10/

  Upstream bug report:
  [2] https://bugzilla.mozilla.org/show_bug.cgi?id=785470

  Upstream patches:
  [3] http://bzr.mozilla.org/bugzilla/trunk/revision/8370
      (against trunk)
  [4] http://bzr.mozilla.org/bugzilla/4.2/revision/8132
      (against 4.2 branch)
  [5] http://bzr.mozilla.org/bugzilla/4.0/revision/7721
      (against 4.0 branch)
  [6] http://bzr.mozilla.org/bugzilla/3.6/revision/7297
      (against 3.6 branch)

  References:
  [7] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3981
  [8] https://bugzilla.mozilla.org/show_bug.cgi?id=785112

2) Common Vulnerabilities and Exposures assigned an identifier CVE-2012-4747 to the following vulnerability:

Bugzilla 2.x and 3.x through 3.6.11, 3.7.x and 4.0.x before 4.0.8, 4.1.x and 4.2.x before 4.2.3, and 4.3.x before 4.3.3 stores potentially sensitive information under the web root with insufficient access control, which allows remote attackers to read (1) template (aka .tmpl) files, (2) other custom extension files under extensions/, or (3) custom documentation files under docs/ via a direct request.

References:
[9]  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4747
[10] http://www.bugzilla.org/security/3.6.10/
[11] https://bugzilla.mozilla.org/show_bug.cgi?id=785511
[12] https://bugzilla.mozilla.org/show_bug.cgi?id=785522
Comment 1 Jan Lieskovsky 2012-09-03 03:49:13 EDT
This issue is scheduled to be corrected via following bugzilla package updates for Fedora:
1) bugzilla-4.0.8-1.fc16 for Fedora-16,
2) bugzilla-4.0.8-1.fc17 for Fedora-17,
3) bugzilla-4.2.3-1.fc18 for Rawhide.

--

This issue affects the versions of the bugzilla package, as shipped with Fedora EPEL 5 and Fedora EPEL 6. Please schedule an update.
Comment 2 Jan Lieskovsky 2012-09-03 03:51:54 EDT
Created bugzilla tracking bugs for this issue

Affects: epel-all [bug 853870]

Note You need to log in before you can comment on or make changes to this bug.