CVS Argumentx command double-free
| cvs-argumentx-double-free (16364) |  High Risk |
Description:
CVS (Concurrent Versions System) have a double-free vulnerability with error_prog_name, which is utilized in error messages and the Argumentx command. The Argumentx command fails to validate if there is an argument in the argument list, when adding additional data to a previously supplied argument. A remote attacker could exploit this vulnerability to execute arbitrary code on the system.
Platforms Affected:
- CVS, Derek Price, CVS (Concurrent Versions System) 1.11.16 and prior
- CVS, Derek Price, CVS (Concurrent Versions System) 1.12.8 and prior
- Debian, Debian Linux 3.0
- FreeBSD, FreeBSD
- Gentoo, Linux
- MandrakeSoft, Mandrake Linux 10.0 AMD64
- MandrakeSoft, Mandrake Linux 10.0
- MandrakeSoft, Mandrake Linux 9.1 PPC
- MandrakeSoft, Mandrake Linux 9.1
- MandrakeSoft, Mandrake Linux 9.2 AMD64
- MandrakeSoft, Mandrake Linux 9.2
- MandrakeSoft, Mandrake Linux Corporate Server 2.1
- MandrakeSoft, Mandrake Linux Corporate Server 2.1 X86_64
- Novell, UnitedLinux 1.0
- OpenPKG, OpenPKG 1.3
- OpenPKG, OpenPKG 2.0
- OpenPKG, OpenPKG CURRENT
- RedHat, Enterprise Linux 2.1 ES
- RedHat, Enterprise Linux 2.1 WS
- RedHat, Enterprise Linux 2.1 AW
- RedHat, Enterprise Linux 2.1 AS
- RedHat, Enterprise Linux 3 WS
- RedHat, Enterprise Linux 3 AS
- RedHat, Enterprise Linux 3 ES
- RedHat, Enterprise Linux 3 Desktop
- RedHat, Linux 3.0
- RedHat, Linux Advanced Workstation 2.1 Itanium
- Slackware, Slackware Linux 8.1
- Slackware, Slackware Linux 9.0
- Slackware, Slackware Linux 9.1
- Slackware, Slackware Linux current
- SuSE, SuSE Linux 8.0
- SuSE, SuSE Linux 8.1
- SuSE, SuSE Linux 8.2
- SuSE, SuSE Linux 9.0
- SuSE, SuSE Linux 9.1
- SuSE, SuSE Linux Enterprise Server 7.0
- SuSE, SuSE Linux Office Server
Remedy:
Upgrade to the latest CVS package, as listed below. Refer to RHSA-2004:233-07 for more information. See References.
Red Hat Enterprise Linux AS (v. 2.1), ES (v. 2.1), WS (v. 2.1), and Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor: 1.11.1p1-16 or later
Red Hat Enterprise Linux AS (v. 3), ES (v. 3), WS (v. 3), Desktop: 1.11.2-24.x86_64 or later
For SuSE Linux:
Upgrade to the latest CVS package, as listed below. Refer to SuSE Security Announcement SuSE-SA:2004:015 for more information. See References.
SuSE Linux 9.1: 1.11.14-24.6 or later
SuSE Linux 9.0: 1.11.6-83 or later
SuSE Linux 8.2: 1.11.5-114 or later
SuSE Linux 8.1: 1.11.1p1-332 or later
SuSE Linux 8.0: 1.11.1p1-332 or later
For Slackware Linux:
Upgrade to the latest cvs package, as listed below. Refer to slackware-security Mailing List, Wed, 9 Jun 2004 14:05:46 -0700 (PDT) for more information. See References.
Slackware Linux 8.1 and 9.0: 1.11.17-i386-1 or later
Slackware Linux 9.1 and -current: 1.11.17-i486 or later
For Mandrake Linux:
Upgrade to the latest cvs package, as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2004:058 : cvs for more information.See References.
Mandrake Linux 9.1: 1.11.16-1.1.91mdk or later
Mandrake Linux 9.2: 1.11.16-1.1.92mdk or later
Mandrake Linux Corporate Server 2.1: 1.11.16-1.1.C21mdk or later
Mandrake Linux 10.0: 1.11.16-1.1.100mdk or later
For Gentoo Linux:
Upgrade to the latest version of cvs (1.11.17 or later), as listed in GLSA 200406-06. See References.
For Debian GNU/Linux 3.0 (alias woody):
Upgrade to the latest cvs package (1.11.1p1debian-9woody7 or later), as listed in DSA-519-1. See References.
For OpenPKG:
Upgrade to the latest cvs package, as listed in OpenPKG Security Advisory OpenPKG-SA-2004.027-cvs. See References.
OpenPKG CURRENT: 1.12.9-20040609 or later
OpenPKG 2.0: 1.12.5-2.0.3 or later
OpenPKG 1.3: 1.12.1-1.3.6 or later
For FreeBSD:
Upgrade to the latest version of cvs, as listed in FreeBSD Security Advisory FreeBSD-SA-04:14.cvs.asc. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Gain Access
References:
- CIAC Information Bulletin O-156, Multiple Vulnerabilities in CVS at http://www.ciac.org/ciac/bulletins/o-156.shtml.
- CIAC Information Bulletin O-156, [CVS Newsfile Revision 1.116.2.104] at http://www.ciac.org/ciac/bulletins/o-156.shtml.
- CVS Web site, Project Download List at http://ccvs.cvshome.org/servlets/ProjectDownloadList.
- FreeBSD Security Advisory FreeBSD-SA-04:14.cvs.asc, cvs at ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:14.cvs.asc.
- Full-Disclosure Mailing List, Wed Jun 09 2004 - 08:00:04 CDT , Advisory 09/2004: More CVS remote vulnerabilities at http://archives.neohapsis.com/archives/fulldisclosure/2004-06/0215.html.
- GLSA 200406-06, CVS: additional DoS and arbitrary code execution at http://www.linuxsecurity.com/content/view/106164/104/.
- Slackware Security Advisories (SSA:2004-161-01), cvs at http://slackware.com/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.427370.
- BID-10499: CVS Multiple Vulnerabilities
- CVE-2004-0416: Double free vulnerability for the error_prog_name string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to execute arbitrary code.
- DSA-519: cvs -- several vulnerabilities
- GLSA-200406-06: CVS: additional DoS and arbitrary code execution vulnerabilities
- MDKSA-2004:058: Updated cvs packages fix multiple vulnerabilities
- OpenPKG-SA-2004.027: CVS
- RHSA-2004-233: cvs security update
- SUSE-SA:2004:015: cvs: remote command execution
Reported:
Jun 09, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net