CVE-2014-1517
published 2014-04-20CVE-2014-1517: The login form in Bugzilla 2.x, 3.x, 4.x before 4.4.3, and 4.5.x before 4.5.3 does not properly handle a correctly authenticated but unintended login attempt…
PriorityP416medium4CVSS 2.0
AVNACLAuSCPINAN
EPSS
1.31%
67.5th percentile
The login form in Bugzilla 2.x, 3.x, 4.x before 4.4.3, and 4.5.x before 4.5.3 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account and then submit a vulnerability report, related to a "login CSRF" issue.
Affected
184 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-1517 bugzilla: flaws fixed in upstream releases 4.5.3, 4.4.3, 4.2.8, and 4.0.12 [fedora-all]
bugzilla·2014-04-22·CVSS 4.0
CVE-2014-1517 [MEDIUM] CVE-2014-1517 bugzilla: flaws fixed in upstream releases 4.5.3, 4.4.3, 4.2.8, and 4.0.12 [fedora-all]
CVE-2014-1517 bugzilla: flaws fixed in upstream releases 4.5.3, 4.4.3, 4.2.8, and 4.0.12 [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Ple
Bugzilla
CVE-2014-1517 bugzilla: flaws fixed in upstream releases 4.5.3, 4.4.3, 4.2.8, and 4.0.12 [epel-all]
bugzilla·2014-04-22·CVSS 4.0
CVE-2014-1517 [MEDIUM] CVE-2014-1517 bugzilla: flaws fixed in upstream releases 4.5.3, 4.4.3, 4.2.8, and 4.0.12 [epel-all]
CVE-2014-1517 bugzilla: flaws fixed in upstream releases 4.5.3, 4.4.3, 4.2.8, and 4.0.12 [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Bugzilla
CVE-2014-1517 bugzilla: flaws fixed in upstream releases 4.5.3, 4.4.3, 4.2.8, and 4.0.12
bugzilla·2014-04-22·CVSS 4.0
CVE-2014-1517 [MEDIUM] CVE-2014-1517 bugzilla: flaws fixed in upstream releases 4.5.3, 4.4.3, 4.2.8, and 4.0.12
CVE-2014-1517 bugzilla: flaws fixed in upstream releases 4.5.3, 4.4.3, 4.2.8, and 4.0.12
The Bugzilla 4.5.3, 4.4.3, 4.2.8, and 4.0.12 releases fix two security issues. Quoting from :
""
Class: Cross-Site Request Forgery
Versions: Bugzilla 2.0 to 4.4.2, 4.5.1 to 4.5.2
Fixed In: 4.4.3, 4.5.3
Description: The login form had no CSRF protection, meaning that
an attacker could force the victim to log in using the
attacker's credentials. If the victim then reports a new
security sensitive bug, the attacker would get immediate
access to this bug.
Due to changes involved in the Bugzilla API, this fix is
not backported to the 4.0 and 4.2 branches, meaning that
Bugzilla 4.0.12 and older, and 4.2.8 and older, will
remain vulnerable to this issue.
References: https://bugzilla.mozilla.org/show_bug.cgi
Bugzilla
[SECURITY] Login form lacks CSRF protection
bugzilla·2011-12-28
[MEDIUM] [SECURITY] Login form lacks CSRF protection
[SECURITY] Login form lacks CSRF protection
Created attachment 584620
patch - v1
[spinning off from bug 471801]
The (CGI-based) login form lacks any type of CSRF protection. This is needed to alleviate the concern specified in section 3 of Adam Barth's CSRF paper (http://seclab.stanford.edu/websec/csrf/csrf.pdf) where an attacker could cause a user to authenticate to Bugzilla using the *attacker's* credentials.
While not optimal, this restricts login form uses to the user's IP plus the time period of MAX_TOKEN_AGE.
Discussion:
Comment on attachment 584620
patch - v1
I've tested this, and it works as expected both with a valid token and without a valid token.
---
Except I just found a bug. :/
---
Created attachment 585083
patch - v2
Previous patch had two bugs
1) Login page wasn
http://git.mozilla.org/?p=bugzilla/bugzilla.git%3Ba=commit%3Bh=0e390970ba51b14a5dc780be7c6f0d6d7baa67e3http://lists.fedoraproject.org/pipermail/package-announce/2014-April/132281.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2014-April/132309.htmlhttp://www.bugzilla.org/security/4.0.11/http://www.securitytracker.com/id/1030128https://bugzilla.mozilla.org/show_bug.cgi?id=713926http://git.mozilla.org/?p=bugzilla/bugzilla.git%3Ba=commit%3Bh=0e390970ba51b14a5dc780be7c6f0d6d7baa67e3http://lists.fedoraproject.org/pipermail/package-announce/2014-April/132281.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2014-April/132309.htmlhttp://www.bugzilla.org/security/4.0.11/http://www.securitytracker.com/id/1030128https://bugzilla.mozilla.org/show_bug.cgi?id=713926
2014-04-20
Published