CVS RCS diff command file creation
| cvs-rcs-create-files (15864) |  Medium Risk |
Description:
CVS (Concurrent Versions System) is vulnerable to a spoofing attack. The CVS Revision Control System (RCS) diff command allows for the creation of files with absolute pathnames. A remote attacker could spoof a malicious CVS server to create or overwrite arbitrary files on the system, once a vulnerable client connects to the server.
Consequences:
File Manipulation
Remedy:
For Red Hat Linux 9:
Upgrade to the latest cvs package (1.11.2-17 or later), as listed in RHSA-2004:154-06. See References.
For Red Hat Linux:
Upgrade to the latest cvs package, as listed below. Refer to RHSA-2004:153-09 for more information. See References.
Red Hat Enterprise Linux AS (v. 2.1), ES (v. 2.1), WS (v. 2.1), and Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor: 1.11.1p1-12 or later
Red Hat Enterprise Linux AS (v. 3), ES (v. 3), and WS (v. 3): 1.11.2-18 or later
For FreeBSD:
Upgrade to the latest version of FreeBSD (4-STABLE, or RELENG_5_2,
RELENG_4_9, or RELENG_4_8 security branch dated later than 2004-04-15), as listed in FreeBSD Security Advisory FreeBSD-SA-04:07.cvs. See References.
— OR —
Apply the patch for this vulnerability, as listed in FreeBSD Security Advisory FreeBSD-SA-04:07.cvs. See References.
For Debian GNU/Linux 3.0 (woody):
Upgrade to the latest cvs package (1.11.1p1debian-9woody2 or later), as listed in DSA-486-1. See References.
For Slackware Linux:
Upgrade to the latest cvs package, as listed below. Refer to slackware-security Mailing List, Sun, 18 Apr 2004 16:40:41 -0700 (PDT) for more information. See References.
Slackware Linux 8.1, 9.0, 9.1, and -current: 0.9.6m-i386-1 or later
For OpenBSD 3.4:
Apply the common/017_cvs.patch, available from the OpenBSD 3.4 errata Web site. See References.
For OpenPKG:
Refer to OpenPKG Security Advisory OpenPKG-SA-2004.013 for patch, upgrade, or suggested workaround information. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
References:
- FreeBSD Security Advisory FreeBSD-SA-04:07.cvs: CVS path validation errors. (From LinuxSecurity archive)
- OpenBSD 3.4 errata Web site: 017: SECURITY FIX: May 5, 2004.
- slackware-security Mailing List, Sun, 18 Apr 2004 16:40:41 -0700 (PDT): cvs security update (SSA:2004-108-02).
- BID-10138: CVS Client RCS Diff File Corruption Vulnerability
- CVE-2004-0180: The client for CVS before 1.11 allows a remote malicious CVS server to create arbitrary files using certain RCS diff files that use absolute pathnames during checkouts or updates, a different vulnerability than CVE-2004-0405.
- DSA-486: cvs -- several vulnerabilities
- GLSA-200404-13: CVS Server and Client Vulnerabilities
- MDKSA-2004:028: Updated cvs packages fix remotely exploitable vulnerability
- OpenPKG-SA-2004.013: CVS
- RHSA-2004-153: cvs security update
- RHSA-2004-154: Updated CVS packages fix security issue
- SA11368: CVS Path Validation Vulnerabilities
Platforms Affected:
- CVS, Derek Price CVS (Concurrent Versions System)
- Debian Debian Linux 3.0
- FreeBSD FreeBSD CURRENT
- Gentoo Linux
- MandrakeSoft Mandrake Linux 10.0
- MandrakeSoft Mandrake Linux 9.1 PPC
- MandrakeSoft Mandrake Linux 9.1
- MandrakeSoft Mandrake Linux 9.2 AMD64
- MandrakeSoft Mandrake Linux 9.2
- MandrakeSoft Mandrake Linux Corporate Server 2.1 X86_64
- MandrakeSoft Mandrake Linux Corporate Server 2.1
- OpenBSD OpenBSD 3.4
- OpenPKG OpenPKG 1.3
- OpenPKG OpenPKG 2.0
- OpenPKG OpenPKG CURRENT
- RedHat Enterprise Linux 2.1 AW
- RedHat Enterprise Linux 2.1 AS
- RedHat Enterprise Linux 2.1 ES
- RedHat Enterprise Linux 2.1 WS
- RedHat Enterprise Linux 3 ES
- RedHat Enterprise Linux 3 AS
- RedHat Enterprise Linux 3 WS
- RedHat Linux 9.0
- RedHat Linux Advanced Workstation 2.1 Itanium
- Slackware Slackware Linux 8.1
- Slackware Slackware Linux 9.0
- Slackware Slackware Linux 9.1
- Slackware Slackware Linux current
- Turbolinux Turbolinux 10 Desktop
- Turbolinux Turbolinux 7 Server
- Turbolinux Turbolinux 7 Workstation
- Turbolinux Turbolinux 8 Server
- Turbolinux Turbolinux 8 Workstation
- Turbolinux Turbolinux Advanced Server 6
- Turbolinux Turbolinux Appliance Server 1.0 Hosting Ed
- Turbolinux Turbolinux Appliance Server 1.0 Workgroup Ed
- Turbolinux Turbolinux Server 6.1
- Turbolinux Turbolinux Server 6.5
- Turbolinux Turbolinux Workstation 6.0
Reported:
Apr 14, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net