CVS Argumentx command double-free
| cvs-argumentx-double-free (16364) |  High Risk |
Description:
CVS (Concurrent Versions System) have a double-free vulnerability with error_prog_name, which is utilized in error messages and the Argumentx command. The Argumentx command fails to validate if there is an argument in the argument list, when adding additional data to a previously supplied argument. A remote attacker could exploit this vulnerability to execute arbitrary code on the system.
Consequences:
Gain Access
Remedy:
Upgrade to the latest CVS package, as listed below. Refer to RHSA-2004:233-07 for more information. See References.
Red Hat Enterprise Linux AS (v. 2.1), ES (v. 2.1), WS (v. 2.1), and Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor: 1.11.1p1-16 or later
Red Hat Enterprise Linux AS (v. 3), ES (v. 3), WS (v. 3), Desktop: 1.11.2-24.x86_64 or later
For SuSE Linux:
Upgrade to the latest CVS package, as listed below. Refer to SuSE Security Announcement SuSE-SA:2004:015 for more information. See References.
SuSE Linux 9.1: 1.11.14-24.6 or later
SuSE Linux 9.0: 1.11.6-83 or later
SuSE Linux 8.2: 1.11.5-114 or later
SuSE Linux 8.1: 1.11.1p1-332 or later
SuSE Linux 8.0: 1.11.1p1-332 or later
For Slackware Linux:
Upgrade to the latest cvs package, as listed below. Refer to slackware-security Mailing List, Wed, 9 Jun 2004 14:05:46 -0700 (PDT) for more information. See References.
Slackware Linux 8.1 and 9.0: 1.11.17-i386-1 or later
Slackware Linux 9.1 and -current: 1.11.17-i486 or later
For Mandrake Linux:
Upgrade to the latest cvs package, as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2004:058 : cvs for more information.See References.
Mandrake Linux 9.1: 1.11.16-1.1.91mdk or later
Mandrake Linux 9.2: 1.11.16-1.1.92mdk or later
Mandrake Linux Corporate Server 2.1: 1.11.16-1.1.C21mdk or later
Mandrake Linux 10.0: 1.11.16-1.1.100mdk or later
For Gentoo Linux:
Upgrade to the latest version of cvs (1.11.17 or later), as listed in GLSA 200406-06. See References.
For Debian GNU/Linux 3.0 (alias woody):
Upgrade to the latest cvs package (1.11.1p1debian-9woody7 or later), as listed in DSA-519-1. See References.
For OpenPKG:
Upgrade to the latest cvs package, as listed in OpenPKG Security Advisory OpenPKG-SA-2004.027-cvs. See References.
OpenPKG CURRENT: 1.12.9-20040609 or later
OpenPKG 2.0: 1.12.5-2.0.3 or later
OpenPKG 1.3: 1.12.1-1.3.6 or later
For FreeBSD:
Upgrade to the latest version of cvs, as listed in FreeBSD Security Advisory FreeBSD-SA-04:14.cvs.asc. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
References:
- CIAC Information Bulletin O-156: Multiple Vulnerabilities in CVS.
- CIAC Information Bulletin O-156: [CVS Newsfile Revision 1.116.2.104].
- CVS Web site: Project Download List.
- FreeBSD Security Advisory FreeBSD-SA-04:14.cvs.asc: cvs.
- Full-Disclosure Mailing List, Wed Jun 09 2004 - 08:00:04 CDT : Advisory 09/2004: More CVS remote vulnerabilities.
- GLSA 200406-06: CVS: additional DoS and arbitrary code execution.
- Slackware Security Advisories (SSA:2004-161-01): cvs.
- BID-10499: CVS Multiple Vulnerabilities
- CVE-2004-0416: Double free vulnerability for the error_prog_name string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to execute arbitrary code.
- DSA-519: cvs -- several vulnerabilities
- GLSA-200406-06: CVS: additional DoS and arbitrary code execution vulnerabilities
- MDKSA-2004:058: Updated cvs packages fix multiple vulnerabilities
- OpenPKG-SA-2004.027: CVS
- RHSA-2004-233: cvs security update
- SUSE-SA:2004:015: cvs: remote command execution
Platforms Affected:
- CVS, Derek Price CVS (Concurrent Versions System) 1.11.16 and prior
- CVS, Derek Price CVS (Concurrent Versions System) 1.12.8 and prior
- Debian Debian Linux 3.0
- FreeBSD FreeBSD
- Gentoo Linux
- MandrakeSoft Mandrake Linux 10.0
- MandrakeSoft Mandrake Linux 10.0 AMD64
- MandrakeSoft Mandrake Linux 9.1
- MandrakeSoft Mandrake Linux 9.1 PPC
- MandrakeSoft Mandrake Linux 9.2 AMD64
- MandrakeSoft Mandrake Linux 9.2
- MandrakeSoft Mandrake Linux Corporate Server 2.1
- MandrakeSoft Mandrake Linux Corporate Server 2.1 X86_64
- Novell SuSE Linux Enterprise Server 7.0
- Novell UnitedLinux 1.0
- OpenPKG OpenPKG 1.3
- OpenPKG OpenPKG 2.0
- OpenPKG OpenPKG CURRENT
- RedHat Enterprise Linux 2.1 AS
- RedHat Enterprise Linux 2.1 ES
- RedHat Enterprise Linux 2.1 AW
- RedHat Enterprise Linux 2.1 WS
- RedHat Enterprise Linux 3 Desktop
- RedHat Enterprise Linux 3 WS
- RedHat Enterprise Linux 3 ES
- RedHat Enterprise Linux 3 AS
- RedHat Linux 3.0
- RedHat Linux Advanced Workstation 2.1 Itanium
- Slackware Slackware Linux 8.1
- Slackware Slackware Linux 9.0
- Slackware Slackware Linux 9.1
- Slackware Slackware Linux current
- SUSE SuSE Linux 8.0
- SUSE SuSE Linux 8.1
- SUSE SuSE Linux 8.2
- SUSE SuSE Linux 9.0
- SUSE SuSE Linux 9.1
- SuSE SuSE Linux Office Server
Reported:
Jun 09, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net