SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   CVS Vendors:   GNU [multiple authors]
CVS Path Validation Flaw in RCS Diff Files Lets Remote Servers Create Arbitrary Files on the Target Client's System
SecurityTracker Alert ID:  1009781
SecurityTracker URL:  http://securitytracker.com/id/1009781
CVE Reference:   CVE-2004-0180   (Links to External Site)
Updated:  Apr 19 2004
Original Entry Date:  Apr 14 2004
Impact:   Modification of system information, Modification of user information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 1.11.15
Description:   A vulnerability was reported in CVS. A remote server can create arbitrary files on a connected user's system.

It is reported that a malicious CVS server can cause arbitrary files to be created or overwritten on a connected target user's system.

The vulnerability resides in the processing of pathnames in RCS diff files. When a target user performs a CVS checkout or update via the network, the target user's client will accept absolute path names.

Sebastian Krahmer is credited with discovering this flaw.

Impact:   A remote server can create or modify arbitrary files on a connected user's system.
Solution:   The vendor has released a fixed version (1.11.15 stable, 1.12.7 development), available at:

http://ccvs.cvshome.org/servlets/ProjectDownloadList

Vendor URL:  www.cvshome.org/ (Links to External Site)
Cause:   Access control error, Input validation error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Apr 15 2004 (Mandrake Issues Fix) CVS Path Validation Flaw in RCS Diff Files Lets Remote Servers Create Arbitrary Files on the Target Client's System
Mandrake has released a fix.
Apr 15 2004 (Red Hat Issues Fix for RH Enterprise Linux) CVS Path Validation Flaw in RCS Diff Files Lets Remote Servers Create Arbitrary Files on the Target Client's System
Red Hat has released a fix for Red Hat Enterprise Linux 2.1 and 3.
Apr 15 2004 (Red Hat Issues Fix for RH Linux) CVS Path Validation Flaw in RCS Diff Files Lets Remote Servers Create Arbitrary Files on the Target Client's System
Red Hat has released a fix for Red Hat Linux 9.
Apr 15 2004 (Gentoo Issues Fix) CVS Path Validation Flaw in RCS Diff Files Lets Remote Servers Create Arbitrary Files on the Target Client's System
Gentoo has released a fix.
Apr 15 2004 (SuSE Issues Fix) CVS Path Validation Flaw in RCS Diff Files Lets Remote Servers Create Arbitrary Files on the Target Client's System
SuSE has released a fix.
Apr 16 2004 (FreeBSD Issues Fix) CVS Path Validation Flaw in RCS Diff Files Lets Remote Servers Create Arbitrary Files on the Target Client's System
FreeBSD has released a fix.
Apr 19 2004 (Debian Issues Fix) CVS Path Validation Flaw in RCS Diff Files Lets Remote Servers Create Arbitrary Files on the Target Client's System
Debian has released a fix.
Apr 19 2004 (Slackware Issues Fix) CVS Path Validation Flaw in RCS Diff Files Lets Remote Servers Create Arbitrary Files on the Target Client's System
The vendor has released a fix.
May 5 2004 (OpenBSD Issues Fix) CVS Path Validation Flaw in RCS Diff Files Lets Remote Servers Create Arbitrary Files on the Target Client's System
OpenBSD has released a fix.
May 18 2004 (Fedora Issues Fix) CVS Path Validation Flaw in RCS Diff Files Lets Remote Servers Create Arbitrary Files on the Target Client's System
Fedora has released a fix.



 Source Message Contents

Subject:  CVE-2004-0180



http://ccvs.cvshome.org/source/browse/ccvs/NEWS?rev=1.116.2.92&content-type=text/x-cvsweb-markup

1.11.15 stable

SERVER SECURITY ISSUES

* Piped checkouts of paths above $CVSROOT no longer work.  Previously, clients
   could have requested the contents of RCS archive files anywhere on a CVS
   server.

CLIENT SECURITY ISSUES

* Clients now check paths from the server to verify that they are within one of
   the sandboxes the user requested be updated.  Previously, a trojan server
   could have written or overwritten files anywhere the user had access,
   presenting a serious security risk.

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC