Bugzilla Bug Exposes Zero-Day Bugs 34
tsu doh nimh writes A previously unknown security flaw in Bugzilla — a popular online bug-tracking tool used by Mozilla and many of the open source Linux distributions — allows anyone to view detailed reports about unfixed vulnerabilities in a broad swath of software. Bugzilla is expected today to issue a fix for this very serious weakness, which potentially exposes a veritable gold mine of vulnerabilities that would be highly prized by cyber criminals and nation-state actors.
Bug redux? (Score:4, Funny)
So I heard you like learning about bugs.
Re: (Score:1)
Re: (Score:1)
Nice going (Score:5, Insightful)
So, instead of waiting for that to be patched, the news is spreading that people can use it to find security holes in a lot of software. I'm all for open formats, open source and whatnot, but this is not a good way to do things regarding security. Warn the people in charge of the project, not the general public.
Re:Nice going (Score:5, Informative)
Warn the people in charge of the project, not the general public.
This is exactly what was done.
“An independent researcher has reported a vulnerability in Bugzilla which allows the manipulation of some database fields at the user creation procedure on Bugzilla, including the ‘login_name’ field,” said Sid Stamm, principal security and privacy engineer at Mozilla, which developed the tool and has licensed it for use under the Mozilla public license.
“This flaw allows an attacker to bypass email verification when they create an account, which may allow that account holder to assume some privileges, depending on how a particular Bugzilla instance is managed,” Stamm said. “There have been no reports from users that sensitive data has been compromised and we have no other reason to believe the vulnerability has been exploited. We expect the fixes to be released on Monday.”
Re:Nice going (Score:5, Interesting)
CheckPoint who noticed this hole wanted to make a point about failure to audit in open source projects: essentially that no one actually audits open source projects unless they are paid to so someone should be paying for auditing. Mozilla foundation doesn't know if anyone actually had exploited this bug and it requires some specifics about how Bugzilla is setup.
Re:Nice going (Score:5, Funny)
Unfortunately they reported the zero day bug about Bugzilla into Bugzilla :)
Yo Dawg! (Score:5, Funny)
We heard you like bugs. So we introduced a bug in your bug-reporting system so you can exploit one bug to exploit other bugs.
Re: (Score:3)
I really think the original article made that joke so much better with the meme they included:
http://krebsonsecurity.com/wp-... [krebsonsecurity.com]
Leaving us to ponder, how many bugs would bug xibit enough for xibit to exhibit bugs?
This whole thing is way too meta, I am going back to bed until it is over.
Re: (Score:3)
And the other one:
Bugception.
Headline does not match subject (Score:3)
So you can register an account with an email from another domain? Still I know of no-bugzilla where security bugs are allowed to be seen by everybody from a certain domain. They are allowed to be seen by certain number of emails, and since they are already registered, you can't create a new account with one of those.
So, not really that much of an issue unless you have really wide permission to everybody from specific email domains.
Re: (Score:3)
Any smallish company where security is not compartmentalized from other development activities but with a public Bugzilla server so users can report bugs and such? You register with a @company.com address and you're assumed to be an in-house developer with access to all your dirty laundry. Not everyone runs on a strict need-to-know basis...
Re:Headline does not match subject (Score:5, Interesting)
You get administrative rights, it's in the Checkpoint report in the article: http://www.checkpoint.com/blog... [checkpoint.com]
And have info about their disclosure:
The Checkpoint article is a lot more professional than the Krebs article No jabs at FOSS either.
This looks like a major company which uses FOSS (IIRC, SPLAT is a Linux-based-platform) made a contribution in discovering a vulnerability in common software.
Re: (Score:2)
You get administrative rights, ...... ......
1.The bug enables unknown users to gain administrative privileges
I suspect the NSA noticed they were not the only ones lurking and slurping up bugs.
Too early in the season for snow to tell anyone they were done.
Zero-Day - redundant. (Score:3, Insightful)
What/why is this obsession/FUD with calling things "Zero-Day" bugs? Is this to suggest that bugs magically appear the 10th day or whatever after release?
A bug/exploit in the software is always there at the zero-day. Doesn't matter if it's found immediately or 20 years from release.
Re:Zero-Day - redundant. (Score:5, Informative)
I thought "Zero day" refered to when the bug or exploit became known to either the developer or public?
Developers can't fix bugs they don't know about it, so "day zero" is really the day the fact that there is a bug becomes known and fixable. Up to that point, including while it is being used in the wild but not yet discovered, it is still "zero day"
That is the obsession on both sides. Criminals want zero days because it means they are ahead of the game. Everyone else worries about them when they are discovered because there is always a question of whether it was already exploited.
Re: (Score:1)
A zero-day exploit is one where someone has an attack based on it prior to the developers having fixed it. See https://en.wikipedia.org/wiki/... [wikipedia.org]
That said, they do seem to be misusing the term here. These seem to be zero-day risks rather than exploits. Attackers don't need to find out about zero-day bugs from bug reports. By definition, they already know about them. Now, once they are exposed and an attack is created, they become zero-day exploits. But until a black hat creates and uses an attack, they
Re: (Score:2)
meta-bug? (Score:1)
I never meta bug I didn't like
-anonymous black-hat
NSA is pissed! (Score:2)
"NOOOO those were supposed to be private! Only for access to authorized Bugzilla users and those with the technical means to steal the information!!! Our precious cyberweapons, RUINED!!! T_T " - NSA
Bug in a bug (Score:5, Funny)
Reminds of the day I called the software developer to report about a bug in the bug reporting software that made it unable to save a bug report. His response was (seriously): "Just create a bug report about the problem".
Re: (Score:2)
Did that report bug you?
Re: (Score:1)
I lost it in the fire.
Re: (Score:2)
Re: (Score:2)
No this was an in-house bug tracking software. All our software products used the bug tracker including of course the bug tracker itself. There was a strict company policy that all bug reports should be created in the bug tracker and you should never contact the developer directly about bugs. No exceptions :)
There's an In Soviet Russia joke here somewhere... (Score:2)
But my joke DB just came down with a SQL injection bug and the best it came up with was "20 bucks, same as in town"
Haha only serious (Score:2)
(N)ation-(S)tate (A)ctors... I see what you did there.