CVE-2014-8630
published 2015-02-01CVE-2014-8630: Bugzilla before 4.0.16, 4.1.x and 4.2.x before 4.2.12, 4.3.x and 4.4.x before 4.4.7, and 5.x before 5.0rc1 allows remote authenticated users to execute…
PriorityP338medium6.5CVSS 2.0
AVNACLAuSCPIPAP
EPSS
2.04%
79.0th percentile
Bugzilla before 4.0.16, 4.1.x and 4.2.x before 4.2.12, 4.3.x and 4.4.x before 4.4.7, and 5.x before 5.0rc1 allows remote authenticated users to execute arbitrary commands by leveraging the editcomponents privilege and triggering crafted input to a two-argument Perl open call, as demonstrated by shell metacharacters in a product name.
Affected
37 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| mozilla | bugzilla | <= 4.0.16 | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-8630 Bugzilla: Command Injection into product names and other attributes
bugzilla·2015-01-23·CVSS 6.5
CVE-2014-8630 [MEDIUM] CVE-2014-8630 Bugzilla: Command Injection into product names and other attributes
CVE-2014-8630 Bugzilla: Command Injection into product names and other attributes
The Bugzilla project reports:
Class: Command Injection
Versions: All versions before 4.0.16, 4.1.1 to 4.2.11, 4.3.1 to 4.4.6,
4.5.1 to 4.5.6
Fixed In: 4.0.16, 4.2.12, 4.4.7, 5.0rc1
Description: Some code in Bugzilla does not properly utilize 3 arguments form
for open() and it is possible for an account with editcomponents
permissions to inject commands into product names and other
attributes.
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1079065
CVE Number: CVE-2014-8630
External references:
http://www.bugzilla.org/security/4.0.15/
Discussion:
Created bugzilla tracking bugs for this issue:
Affects: fedora-all [bug 1185484]
Affects: epel-all [bug 1185485]
---
bugzilla-4.4.8-1.fc21.1 has been
Bugzilla
CVE-2014-8630 Bugzilla: Command Injection into product names and other attributes [epel-all]
bugzilla·2015-01-23·CVSS 6.5
CVE-2014-8630 [MEDIUM] CVE-2014-8630 Bugzilla: Command Injection into product names and other attributes [epel-all]
CVE-2014-8630 Bugzilla: Command Injection into product names and other attributes [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple su
Bugzilla
CVE-2014-8630 Bugzilla: Command Injection into product names and other attributes [fedora-all]
bugzilla·2015-01-23·CVSS 6.5
CVE-2014-8630 [MEDIUM] CVE-2014-8630 Bugzilla: Command Injection into product names and other attributes [fedora-all]
CVE-2014-8630 Bugzilla: Command Injection into product names and other attributes [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple suppo
Bugzilla
[SECURITY] Always use the 3 arguments form for open() to prevent shell code injection
bugzilla·2014-10-07
[MEDIUM] [SECURITY] Always use the 3 arguments form for open() to prevent shell code injection
[SECURITY] Always use the 3 arguments form for open() to prevent shell code injection
User Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; Touch; .NET4.0E; .NET4.0C; Tablet PC 2.0; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; rv:11.0) like Gecko
Steps to reproduce:
I noticed this during a cursory look through 4.4.6 to examine the other security issues that were fixed.
The filtering of the product name before the 2 arg open in reports.cgi generate_chart() only sanitizes against path traversal attacks. 2 arg open in perl is generally exploitable for shell code injection if the attacker can control the first or last character of the filename. As far as I can tell, an attacker could leverage this input point IF they have enough permissions to control a project name.
http://advisories.mageia.org/MGASA-2015-0048.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-February/149921.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-February/149925.htmlhttp://www.bugzilla.org/security/4.0.15/http://www.mandriva.com/security/advisories?name=MDVSA-2015:030https://bugzilla.mozilla.org/show_bug.cgi?id=1079065https://security.gentoo.org/glsa/201607-11http://advisories.mageia.org/MGASA-2015-0048.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-February/149921.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-February/149925.htmlhttp://www.bugzilla.org/security/4.0.15/http://www.mandriva.com/security/advisories?name=MDVSA-2015:030https://bugzilla.mozilla.org/show_bug.cgi?id=1079065https://security.gentoo.org/glsa/201607-11
2015-02-01
Published