CVS Path Validation Flaw in RCS Diff Files Lets Remote Servers Create Arbitrary Files on the Target Client's System
|
|
SecurityTracker Alert ID: 1009781 |
|
SecurityTracker URL: http://securitytracker.com/id/1009781
|
|
CVE Reference:
CAN-2004-0180
(Links to External Site)
|
Updated: Apr 19 2004
|
Original Entry Date: Apr 14 2004
|
Impact:
Modification of system information, Modification of user information, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 1.11.15
|
Description:
A vulnerability was reported in CVS. A remote server can create arbitrary files on a connected user's system.
It is reported that a malicious CVS server can cause arbitrary files to be created or overwritten on a connected target user's system.
The vulnerability resides in the processing of pathnames in RCS diff files. When a target user performs a CVS checkout or update via the network, the target user's client will accept absolute path names.
Sebastian Krahmer is credited with discovering this flaw.
|
Impact:
A remote server can create or modify arbitrary files on a connected user's system.
|
Solution:
The vendor has released a fixed version (1.11.15 stable, 1.12.7 development), available at:
http://ccvs.cvshome.org/servlets/ProjectDownloadList
|
Vendor URL: www.cvshome.org/ (Links to External Site)
|
Cause:
Access control error, Input validation error
|
Underlying OS:
Linux (Any), UNIX (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Wed, 14 Apr 2004 14:05:19 -0400
Subject: CAN-2004-0180
|
http://ccvs.cvshome.org/source/browse/ccvs/NEWS?rev=1.116.2.92&content-type=text/x-cvsweb-markup
1.11.15 stable
SERVER SECURITY ISSUES
* Piped checkouts of paths above $CVSROOT no longer work. Previously, clients
could have requested the contents of RCS archive files anywhere on a CVS
server.
CLIENT SECURITY ISSUES
* Clients now check paths from the server to verify that they are within one of
the sandboxes the user requested be updated. Previously, a trojan server
could have written or overwritten files anywhere the user had access,
presenting a serious security risk.
|
|
