SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   CVS Vendors:   GNU [multiple authors]
(OpenBSD Issues Fix) CVS Entry Line Heap Overflow Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1010248
SecurityTracker URL:  http://securitytracker.com/id/1010248
CVE Reference:   CVE-2004-0396   (Links to External Site)
Date:  May 21 2004
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 1.11.15 and prior versions (stable); 1.12.7 and prior versions (feature)
Description:   A heap overflow vulnerability was reported in Concurrent Versions System (CVS) in the processing of entry lines. A remote user can execute arbitrary code on the target system.

Stefan Esser of e-matters GmbH reported that the overflow occurs when an entry line is processed to determine if the modified and unchanged flags apply. A remote user can reportedly cause the flawed function to be called several times, inserting certain characters into the entry line and overwriting memory.

The vendor was reportedly notified on May 2, 2004.

The original advisory is available at:

http://security.e-matters.de/advisories/072004.html

Impact:   A remote user can execute arbitrary code on the target system with the privileges of the CVS server.
Solution:   OpenBSD has released a fix in OpenBSD-current as well as the 3.5-stable and 3.4-stable branches. Also, patches are available at:

ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/007_cvs2.patch
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/021_cvs2.patch

Vendor URL:  www.cvshome.org/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  UNIX (OpenBSD)
Underlying OS Comments:  3.4, 3.5

Message History:   This archive entry is a follow-up to the message listed below.
May 19 2004 CVS Entry Line Heap Overflow Lets Remote Users Execute Arbitrary Code



 Source Message Contents

Subject:  cvs server buffer overflow vulnerability



Stefan Esser discovered a heap overflow in the CVS server that can be
exploited by clients sending malformed requests, enabling these clients to
run arbitrary code with the same privileges as the CVS server program.

CVE ID: CAN-2004-0396

The problem has been fixed in OpenBSD-current as well as the 3.5-stable
and 3.4-stable branches.

Patches are available from:
    ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/007_cvs2.patch
    ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/021_cvs2.patch

For more information, see:
    http://marc.theaimsgroup.com/?l=bugtraq&m=108498454829020&w=2
    http://ccvs.cvshome.org/servlets/NewsItemView?newsID=107



 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC