Bugzilla Cross Site Scripting and HTTP Response Splitting Vulnerabilities


Description   Multiple vulnerabilities have been identified in Bugzilla, which could be exploited by attackers to gain knowledge of sensitive information.
The first issue is caused by an input validation error when processing user-supplied URLs, which could allow attackers to inject headers and content in a user's browser.
The second issue is caused by an error in the Old Charts system that generates graphs in the "graphs/" directory with predictable names, which could allow attackers to view product names and charted information.
The third vulnerability is caused by an input validation error in YUI, which could allow cross site scripting attacks.
     
Vulnerable Products   Vulnerable Software:
Bugzilla versions 2.xBugzilla versions prior to 3.2.9Bugzilla versions prior to 3.4.9Bugzilla versions prior to 3.6.3Bugzilla versions prior to 4.0rc1
     
Solution   Upgrade to Bugzilla version 3.2.9, 3.4.9, 3.6.3, or 4.0rc1 : http://www.bugzilla.org/download/
     
CVE   CVE-2010-4209
CVE-2010-4208
CVE-2010-4207
CVE-2010-3764
CVE-2010-3172
     
References   http://www.bugzilla.org/security/3.2.8/
     
Vulnerability Manager Detection   No
     
IPS Protection  
ASQ Engine alarm Available Since
XSS - Prevention - GET : suspicious 'iframe' tag found in URL
3.2.0
XSS - Prevention - POST : suspicious tag with event found in data
3.2.0
HTTP Request Smuggling : HTTP command found in header
3.2.0
XSS - Prevention - GET : suspicious tag with event found in URL
3.2.0
XSS - Prevention - POST : suspicious 'object' tag found in data
3.2.0
XSS - Prevention - GET : suspicious 'applet' tag found in URL
3.2.0
XSS - Prevention - POST : suspicious 'applet' tag found in data
3.2.0
XSS - Prevention - POST : 'location' javascript object found in data
3.2.0
XSS - Phishing : suspicious 'div' tag found in URL
3.2.0
XSS - Prevention - GET : suspicious 'style' attribute found in URL
3.2.0
XSS - Prevention - POST : javascript code found in data
3.2.0
XSS - Prevention - POST : suspicious 'iframe' tag found in data
3.2.0
XSS - Prevention - POST : code allowing cookie access found in data
3.2.0
XSS - Phishing : suspicious 'a' tag found in URL
3.2.0
XSS - Prevention - GET : cookie access attempt using script language found in URL
3.2.0
XSS - Prevention - GET : suspicious 'embed' tag found in URL
3.2.0
XSS - Prevention - GET : suspicious 'object' tag found in URL
3.2.0
XSS - Phishing : suspicious 'form' tag found in URL
3.2.0
HTTP Request Smuggling : Content-Length and Transfer-Encoding: chunked fields in header
3.2.0
XSS - Prevention - POST : suspicious 'embed' tag found in data
3.2.0
XSS - Prevention - POST : suspicious 'style' tag found in data
3.2.0
XSS - Prevention - GET : javascript code found in URL
3.2.0
XSS - Prevention - POST : suspicious 'div' tag found in data
3.2.0
XSS - Prevention - GET : evasion attempt using tag characters encoding in URL
3.2.0
XSS - Prevention - GET : suspicious 'style' tag found in URL
3.2.0
HTTP Request Smuggling : suspicious syntax using HTTP keyword
3.2.0
XSS - Phishing : suspicious 'link' tag found in URL
3.2.0
XSS - Prevention - GET : 'script' tag found in URL
3.2.0
HTTP Request Smuggling : multiple Content-Length fields
3.2.0
XSS - Prevention - POST : 'script' tag found in data
3.2.0
XSS - Prevention - POST : suspicious 'style' attribute found in data
3.2.0
XSS - Prevention - GET : 'location' javascript object found in URL
3.2.0
XSS - Prevention - GET : suspicious 'div' tag found in URL
3.2.0
     


 
 
 
 
 Risk level 
Low 

 Vulnerability First Public Report Date 
2010-11-03 

 Target Type 
Client 

 Possible exploit 
Local & Remote