Vulnerabilities > CVE-2013-0786 - Information Exposure vulnerability in Mozilla Bugzilla

#%NASL_MIN_LEVEL 80502

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Mandriva Linux Security Advisory MDVSA-2013:066. 
# The text itself is copyright (C) Mandriva S.A.
#

if (NASL_LEVEL < 3000) exit(0);

include("compat.inc");

if (description)
{
  script_id(66080);
  script_version("1.8");
  script_cvs_date("Date: 2019/08/02 13:32:55");

  script_cve_id("CVE-2012-1969", "CVE-2012-3981", "CVE-2012-4189", "CVE-2012-4197", "CVE-2012-4198", "CVE-2012-4199", "CVE-2012-5883", "CVE-2013-0785", "CVE-2013-0786");
  script_bugtraq_id(54708, 55349, 56385, 56504, 58001, 58060);
  script_xref(name:"MDVSA", value:"2013:066");

  script_name(english:"Mandriva Linux Security Advisory : bugzilla (MDVSA-2013:066)");
  script_summary(english:"Checks rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Mandriva Linux host is missing one or more security
updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Multiple vulnerablilities was identified and fixed in bugzilla :

The get_attachment_link function in Template.pm in Bugzilla 2.x and
3.x before 3.6.10, 3.7.x and 4.0.x before 4.0.7, 4.1.x and 4.2.x
before 4.2.2, and 4.3.x before 4.3.2 does not check whether an
attachment is private before presenting the attachment description
within a public comment, which allows remote attackers to obtain
sensitive description information by reading a comment
(CVE-2012-1969).

Auth/Verify/LDAP.pm in Bugzilla 2.x and 3.x before 3.6.11, 3.7.x and
4.0.x before 4.0.8, 4.1.x and 4.2.x before 4.2.3, and 4.3.x before
4.3.3 does not restrict the characters in a username, which might
allow remote attackers to inject data into an LDAP directory via a
crafted login attempt (CVE-2012-3981).

Cross-site scripting (XSS) vulnerability in Bugzilla 4.1.x and 4.2.x
before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1, allows remote
attackers to inject arbitrary web script or HTML via a field value
that is not properly handled during construction of a tabular report,
as demonstrated by the Version field (CVE-2012-4189).

Bugzilla/Attachment.pm in attachment.cgi in Bugzilla 2.x and 3.x
before 3.6.12, 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before
4.2.4, and 4.3.x and 4.4.x before 4.4rc1 allows remote attackers to
read attachment descriptions from private bugs via an obsolete=1
insert action (CVE-2012-4197).

The User.get method in Bugzilla/WebService/User.pm in Bugzilla 3.7.x
and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and
4.4.x before 4.4rc1 has a different outcome for a groups request
depending on whether a group exists, which allows remote authenticated
users to discover private group names by observing whether a call
throws an error (CVE-2012-4198).

template/en/default/bug/field-events.js.tmpl in Bugzilla 3.x before
3.6.12, 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4,
and 4.3.x and 4.4.x before 4.4rc1 generates JavaScript function calls
containing private product names or private component names in certain
circumstances involving custom-field visibility control, which allows
remote attackers to obtain sensitive information by reading HTML
source code (CVE-2012-4199).

Cross-site scripting (XSS) vulnerability in the Flash component
infrastructure in YUI 2.8.0 through 2.9.0, as used in Bugzilla 3.7.x
and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and
4.4.x before 4.4rc1, allows remote attackers to inject arbitrary web
script or HTML via vectors related to swfstore.swf, a similar issue to
CVE-2010-4209 (CVE-2012-5883).

Cross-site scripting (XSS) vulnerability in show_bug.cgi in Bugzilla
before 3.6.13, 3.7.x and 4.0.x before 4.0.10, 4.1.x and 4.2.x before
4.2.5, and 4.3.x and 4.4.x before 4.4rc2 allows remote attackers to
inject arbitrary web script or HTML via the id parameter in
conjunction with an invalid value of the format parameter
(CVE-2013-0785).

The Bugzilla::Search::build_subselect function in Bugzilla 2.x and 3.x
before 3.6.13 and 3.7.x and 4.0.x before 4.0.10 generates different
error messages for invalid product queries depending on whether a
product exists, which allows remote attackers to discover private
product names by using debug mode for a query (CVE-2013-0786).

The updated packages have upgraded to the 4.2.5 version which is not
vulnerable to these issues"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected bugzilla and / or bugzilla-contrib packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:bugzilla");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:bugzilla-contrib");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:mandriva:business_server:1");

  script_set_attribute(attribute:"patch_publication_date", value:"2013/04/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2013/04/20");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Mandriva Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Mandrake/release")) audit(AUDIT_OS_NOT, "Mandriva / Mandake Linux");
if (!get_kb_item("Host/Mandrake/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^(amd64|i[3-6]86|x86_64)$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Mandriva / Mandrake Linux", cpu);


flag = 0;
if (rpm_check(release:"MDK-MBS1", reference:"bugzilla-4.2.5-1.mbs1")) flag++;
if (rpm_check(release:"MDK-MBS1", reference:"bugzilla-contrib-4.2.5-1.mbs1")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(64878);
  script_version("1.11");
  script_cvs_date("Date: 2019/12/04");

  script_cve_id("CVE-2013-0785", "CVE-2013-0786");
  script_bugtraq_id(58001, 58060);

  script_name(english:"Bugzilla < 3.6.13 / 4.0.10 / 4.2.5 / 4.4rc2 Multiple Vulnerabilities");
  script_summary(english:"Checks Bugzilla version number");

  script_set_attribute(attribute:"synopsis", value:
"The remote web server contains a CGI application that suffers from
multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"According to its banner, the version of Bugzilla installed on the
remote host is affected by multiple vulnerabilities :

  - A cross-site scripting vulnerability exists due to a
    flaw in the validation of the 'id' parameter upon
    submission of the 'show_bug.cgi' script.  An attacker
    can leverage this to inject arbitrary HTML and script
    code in a user's browser to be executed within the
    security context of the affected site.  Note that this
    affects versions 2.0 to 3.6.12, 3.7.1 to 4.0.9,
    4.1.1 to 4.2.4, and 4.3.1 to 4.4rc1.
    (CVE-2013-0785)

  - An information leak issue exists when running a query
    in debug mode.  This can lead to the display of the
    SQL query used to collect the data.  Confidential
    information could be leaked in the SQL query that is
    displayed.	Note that this affects versions 2.17.1 to
    3.6.12, and 3.7.1 to 4.0.9.  (CVE-2013-0786)

Note that Nessus has not tested for these issues but has instead
relied only on the application's self-reported version number.");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.mozilla.org/show_bug.cgi?id=842038");
  script_set_attribute(attribute:"see_also", value:"http://www.bugzilla.org/security/3.6.12/");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Bugzilla 3.6.13 / 4.0.10 / 4.2.5 / 4.4rc2 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2013-0786");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);

  script_set_attribute(attribute:"vuln_publication_date", value:"2012/12/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2013/02/19");
  script_set_attribute(attribute:"plugin_publication_date", value:"2013/02/25");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:bugzilla");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("bugzilla_detect.nasl");
  script_require_keys("installed_sw/Bugzilla", "Settings/ParanoidReport");
  script_exclude_keys("Settings/disable_cgi_scanning");
  script_require_ports("Services/www", 80);

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("http.inc");
include("install_func.inc");

if (report_paranoia < 2) audit(AUDIT_PARANOID);

app = 'Bugzilla';
get_install_count(app_name:app, exit_if_zero:TRUE);

port = get_http_port(default:80);

install = get_single_install(
  app_name : app,
  port     : port,
  exit_if_unknown_ver : TRUE
);

dir = install["path"];
version = install["version"];

install_loc = build_url(port:port, qs:dir + "/query.cgi");

ver = split(version, sep:".", keep:FALSE);
for (i=0; i<max_index(ver); i++)
  ver[i] = int(ver[i]);

# Versions less than 3.6.13 / 4.0.10 / 4.2.5 / 4.4rc2 are vulnerable
# Specific ranges were provided by bugzilla.org/security/3.6.12/
if (
  # 2.0 to 3.6.12
  (ver[0] == 2 && ver[1] >= 0) ||
  (ver[0] == 3 && ver[1] < 6) ||
  (ver[0] == 3 && ver[1] == 6 && ver[2] < 13) ||

  # 3.7.1 to 4.0.9
  (ver[0] == 3 && ver[1] == 7 && ver[2] > 0) ||
  (ver[0] == 3 && ver[1] > 7) ||
  (ver[0] == 4 && ver[1] == 0 && ver[2] < 10) ||

  # 4.1.1 to 4.2.4
  (ver[0] == 4 && ver[1] == 1 && ver[2] > 0) ||
  (ver[0] == 4 && ver[1] == 2 && ver[2] < 5) ||

  # 4.3.1 to 4.4rc1
  (ver[0] == 4 && ver[1] == 3 && ver[2] > 0) ||
  (version =~ "^4\.4rc1")
)
{
  set_kb_item(name:'www/'+port+'/XSS', value:TRUE);
  if (report_verbosity > 0)
  {
    report =
      '\n  URL               : ' +install_loc+
      '\n  Installed version : ' +version+
      '\n  Fixed version     : 3.6.13 / 4.0.10 / 4.2.5 / 4.4rc2\n';
    security_warning(port:port, extra:report);
  }
  else security_warning(port);
}
else audit(AUDIT_WEB_APP_NOT_AFFECTED, app, install_loc, version);