Bugzilla Syncshadowdb不安全临时文件创建漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1196765 漏洞类型 设计错误
发布时间 2005-12-26 更新时间 2007-11-15
CVE编号 CVE-2005-4534 CNNVD-ID CNNVD-200512-572
漏洞平台 N/A CVSS评分 7.5
|漏洞来源
https://www.securityfocus.com/bid/16061
https://cxsecurity.com/issue/WLB-2005120078
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200512-572
|漏洞详情
Bugzilla2.9至2.16.10版本中的shadow数据库(syncshadowdb)特性使得本地用户可以通过对任意文件发起symlink攻击来重写任意代码。
|漏洞EXP
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Bugzilla Security Advisory
==========================

December 27, 2005

Summary
=======

Bugzilla is a Web-based bug-tracking system, used by a large number of
software projects.

This advisory covers an insecure temporary filename handling issue in
versions of Bugzilla prior to 2.16.11 which make use of the shadow
database feature.  Versions 2.18 and newer are not affected, nor are
older installations which do not use the shadow database.

Vulnerability Details
=====================

Class:       Insecure temporary filename handling
Impact:      Privilege escalation
Where:       Local system
Versions:    2.9 through 2.16.10.  Newer versions are not
             affected.
Description: Bugzilla uses a script called syncshadowdb to manually
             replicate data between a master database and a slave.
             The script uses temporary files in an unsafe way since it
             selects a name for the file based on PID and does not make
             any effort to determine if the file exists and if it is a
             symlink. A local user could use this to direct symlink
             attacks and overwrite files that Bugzilla has access to.
Reference:   https://bugzilla.mozilla.org/show_bug.cgi?id=305353
CVE Name:    CVE-2005-4534

Vulnerability Solutions
=======================

The fix for this security issue will be included in the upcoming 2.16.11
release of Bugzilla.  In the meantime, the patch to fix this issue can
be obtained from the URL listed in the reference above.  The patch only
touches the syncshadowdb file.

Please note that Bugzilla version 2.16.* is an older release and very
near end-of-life of its security support.  Users are advised to upgrade
to the latest stable release as soon as possible to continue to receive
security support.

Credits
=======

The Bugzilla team wish to thank the following people for their
assistance in locating, advising us of, and assisting us to fix
these situations:

Javier Fern??ndez-Sanguino Pe??a
Teemu Mannermaa

General information about the Bugzilla bug-tracking system can be found
at http://www.bugzilla.org/

Comments and follow-ups can be directed to the
netscape.public.mozilla.webtools newsgroup or the mozilla-webtools
mailing list; http://www.bugzilla.org/support/ has directions for
accessing these forums.

-30-

- --
Dave Miller                                   http://www.justdave.net/
System Administrator, Mozilla Corporation      http://www.mozilla.com/
Project Leader, Bugzilla Bug Tracking System  http://www.bugzilla.org/

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFDsik10YeDAOcbS44RAvYVAJ9xDYMFmbHBROQtoeKhGdR5dtQtogCeKSMP
4aHgh2NGh1pAOVSaV/Xdcf4=
=FDTk
-----END PGP SIGNATURE-----
|受影响的产品
Mozilla Bugzilla 2.16.9 Mozilla Bugzilla 2.16.8 Mozilla Bugzilla 2.16.7 Mozilla Bugzilla 2.16.6 Mozilla Bugzilla 2.16.5 Mozilla Bugzilla 2.16.4 Mozilla B
|参考资料

来源:bugzilla.mozilla.org
链接:https://bugzilla.mozilla.org/show_bug.cgi?id=305353
来源:BID
名称:16061
链接:http://www.securityfocus.com/bid/16061
来源:SECTRACK
名称:1015411
链接:http://securitytracker.com/id?1015411
来源:SECUNIA
名称:18218
链接:http://secunia.com/advisories/18218
来源:MISC
链接:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=329387
来源:BUGTRAQ
名称:20051228[BUGZILLA]SecurityadvisoryforBugzilla<2.16.11
链接:http://www.securityfocus.com/archive/1/archive/1/420353/100/0/threaded
来源:XF
名称:bugzilla-syncshadowdb-symlink(23863)
链接:http://xforce.iss.net/xforce/xfdb/23863
来源:DEBIAN
名称:DSA-1208
链接:http://www.debian.org/security/2006/dsa-1208
来源:SREASON
名称:302
链接:http://securityreason.com/securityalert/302
来源:SECUNIA
名称:22826
链接:http://secunia.com/advisories/22826