CVS RCS diff command file creation

cvs-rcs-create-files (15864)

Medium Risk

Description:

CVS (Concurrent Versions System) is vulnerable to a spoofing attack. The CVS Revision Control System (RCS) diff command allows for the creation of files with absolute pathnames. A remote attacker could spoof a malicious CVS server to create or overwrite arbitrary files on the system, once a vulnerable client connects to the server.

Platforms Affected:

• CVS, Derek Price, CVS (Concurrent Versions System)
• Debian, Debian Linux 3.0
• FreeBSD, FreeBSD CURRENT
• Gentoo, Linux
• MandrakeSoft, Mandrake Linux 10.0
• MandrakeSoft, Mandrake Linux 9.1
• MandrakeSoft, Mandrake Linux 9.1 PPC
• MandrakeSoft, Mandrake Linux 9.2 AMD64
• MandrakeSoft, Mandrake Linux 9.2
• MandrakeSoft, Mandrake Linux Corporate Server 2.1 X86_64
• MandrakeSoft, Mandrake Linux Corporate Server 2.1
• OpenBSD, OpenBSD 3.4
• OpenPKG, OpenPKG 1.3
• OpenPKG, OpenPKG 2.0
• OpenPKG, OpenPKG CURRENT
• RedHat, Enterprise Linux 2.1 AW
• RedHat, Enterprise Linux 2.1 WS
• RedHat, Enterprise Linux 2.1 ES
• RedHat, Enterprise Linux 2.1 AS
• RedHat, Enterprise Linux 3 WS
• RedHat, Enterprise Linux 3 ES
• RedHat, Enterprise Linux 3 AS
• RedHat, Linux 9.0
• RedHat, Linux Advanced Workstation 2.1 Itanium
• Slackware, Slackware Linux 8.1
• Slackware, Slackware Linux 9.0
• Slackware, Slackware Linux 9.1
• Slackware, Slackware Linux current
• Turbolinux, Turbolinux 10 Desktop
• Turbolinux, Turbolinux 7 Server
• Turbolinux, Turbolinux 7 Workstation
• Turbolinux, Turbolinux 8 Server
• Turbolinux, Turbolinux 8 Workstation
• Turbolinux, Turbolinux Advanced Server 6
• Turbolinux, Turbolinux Appliance Server 1.0 Hosting Ed
• Turbolinux, Turbolinux Appliance Server 1.0 Workgroup Ed
• Turbolinux, Turbolinux Server 6.1
• Turbolinux, Turbolinux Server 6.5
• Turbolinux, Turbolinux Workstation 6.0

Remedy:

For Red Hat Linux 9:
Upgrade to the latest cvs package (1.11.2-17 or later), as listed in RHSA-2004:154-06. See References.

For Red Hat Linux:
Upgrade to the latest cvs package, as listed below. Refer to RHSA-2004:153-09 for more information. See References.

Red Hat Enterprise Linux AS (v. 2.1), ES (v. 2.1), WS (v. 2.1), and Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor: 1.11.1p1-12 or later

Red Hat Enterprise Linux AS (v. 3), ES (v. 3), and WS (v. 3): 1.11.2-18 or later

For FreeBSD:
Upgrade to the latest version of FreeBSD (4-STABLE, or RELENG_5_2, RELENG_4_9, or RELENG_4_8 security branch dated later than 2004-04-15), as listed in FreeBSD Security Advisory FreeBSD-SA-04:07.cvs. See References.

— OR —

Apply the patch for this vulnerability, as listed in FreeBSD Security Advisory FreeBSD-SA-04:07.cvs. See References.

For Debian GNU/Linux 3.0 (woody):
Upgrade to the latest cvs package (1.11.1p1debian-9woody2 or later), as listed in DSA-486-1. See References.

For Slackware Linux:
Upgrade to the latest cvs package, as listed below. Refer to slackware-security Mailing List, Sun, 18 Apr 2004 16:40:41 -0700 (PDT) for more information. See References.

Slackware Linux 8.1, 9.0, 9.1, and -current: 0.9.6m-i386-1 or later

For OpenBSD 3.4:
Apply the common/017_cvs.patch, available from the OpenBSD 3.4 errata Web site. See References.

For OpenPKG:
Refer to OpenPKG Security Advisory OpenPKG-SA-2004.013 for patch, upgrade, or suggested workaround information. See References.

For other distributions:
Contact your vendor for upgrade or patch information.

Consequences:

File Manipulation

References:

• FreeBSD Security Advisory FreeBSD-SA-04:07.cvs, CVS path validation errors at http://www.linuxsecurity.com/content/view/105945/103/. (From LinuxSecurity archive)
• OpenBSD 3.4 errata Web site, 017: SECURITY FIX: May 5, 2004 at http://www.openbsd.org/errata34.html.
• slackware-security Mailing List, Sun, 18 Apr 2004 16:40:41 -0700 (PDT), cvs security update (SSA:2004-108-02) at http://www.slackware.org/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.400181.
• BID-10138: CVS Client RCS Diff File Corruption Vulnerability
• CVE-2004-0180: The client for CVS before 1.11 allows a remote malicious CVS server to create arbitrary files using certain RCS diff files that use absolute pathnames during checkouts or updates, a different vulnerability than CVE-2004-0405.
• DSA-486: cvs -- several vulnerabilities
• GLSA-200404-13: CVS Server and Client Vulnerabilities
• MDKSA-2004:028: Updated cvs packages fix remotely exploitable vulnerability
• OpenPKG-SA-2004.013: CVS
• RHSA-2004-153: cvs security update
• RHSA-2004-154: Updated CVS packages fix security issue
• SA11368: CVS Path Validation Vulnerabilities

Reported:

Apr 14, 2004

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email xforce@iss.net

Return to the main page