Bugzilla Bug Exposes Zero-Day Bugs

tsu doh nimh writes A previously unknown security flaw in Bugzilla — a popular online bug-tracking tool used by Mozilla and many of the open source Linux distributions — allows anyone to view detailed reports about unfixed vulnerabilities in a broad swath of software. Bugzilla is expected today to issue a fix for this very serious weakness, which potentially exposes a veritable gold mine of vulnerabilities that would be highly prized by cyber criminals and nation-state actors.

Comments

Bug redux?

[Anonymous Coward]

So I heard you like learning about bugs.

Nice going

[ArcadeMan]

So, instead of waiting for that to be patched, the news is spreading that people can use it to find security holes in a lot of software. I'm all for open formats, open source and whatnot, but this is not a good way to do things regarding security. Warn the people in charge of the project, not the general public.

Re:Nice going

[Vellmont]

Warn the people in charge of the project, not the general public.

This is exactly what was done.

“An independent researcher has reported a vulnerability in Bugzilla which allows the manipulation of some database fields at the user creation procedure on Bugzilla, including the ‘login_name’ field,” said Sid Stamm, principal security and privacy engineer at Mozilla, which developed the tool and has licensed it for use under the Mozilla public license.

“This flaw allows an attacker to bypass email verification when they create an account, which may allow that account holder to assume some privileges, depending on how a particular Bugzilla instance is managed,” Stamm said. “There have been no reports from users that sensitive data has been compromised and we have no other reason to believe the vulnerability has been exploited. We expect the fixes to be released on Monday.”

Re:Nice going

[jbolden]

CheckPoint who noticed this hole wanted to make a point about failure to audit in open source projects: essentially that no one actually audits open source projects unless they are paid to so someone should be paying for auditing. Mozilla foundation doesn't know if anyone actually had exploited this bug and it requires some specifics about how Bugzilla is setup.

Re:Nice going

[kbg]

Unfortunately they reported the zero day bug about Bugzilla into Bugzilla :)

Yo Dawg!

[CajunArson]

We heard you like bugs. So we introduced a bug in your bug-reporting system so you can exploit one bug to exploit other bugs.

Re:Zero-Day - redundant.

[TheCarp]

I thought "Zero day" refered to when the bug or exploit became known to either the developer or public?

Developers can't fix bugs they don't know about it, so "day zero" is really the day the fact that there is a bug becomes known and fixable. Up to that point, including while it is being used in the wild but not yet discovered, it is still "zero day"

That is the obsession on both sides. Criminals want zero days because it means they are ahead of the game. Everyone else worries about them when they are discovered because there is always a question of whether it was already exploited.

Bug in a bug

[kbg]

Reminds of the day I called the software developer to report about a bug in the bug reporting software that made it unable to save a bug report. His response was (seriously): "Just create a bug report about the problem".

Re:Headline does not match subject

[Dr. Evil]

You get administrative rights, it's in the Checkpoint report in the article: http://www.checkpoint.com/blog...

Analysis by Check Point security researchers revealed how this particular vulnerability could be exploited by attackers:
1.The bug enables unknown users to gain administrative privileges
2.By using these admin credentials, attackers can then view and edit private and undisclosed bug details. Software bug tracking data is typically closely guarded as it exposes software vulnerabilities and known issues
3.Furthermore, this access allows attackers to exploit design weaknesses, or even irreversibly destroy bug data, slowing down development

And have info about their disclosure:

September 29th – Vulnerability discovered and verified by Check Point security researchers
September 30th – Report submitted to the Bugzilla team
September 30th – Acknowledgement and confirmation of vulnerability and severity received by Mozilla
September 30th – Bugzilla team privately shared preliminary patch with prominent Bugzilla installations
October 6th – Security advisory and final patch released

The Checkpoint article is a lot more professional than the Krebs article No jabs at FOSS either.

This looks like a major company which uses FOSS (IIRC, SPLAT is a Linux-based-platform) made a contribution in discovering a vulnerability in common software.