CVS entry line denial of service
| cvs-entry-line-dos (16372) |  Low Risk |
Description:
CVS (Concurrent is vulnerable to a denial of service attack. A remote attacker could supply a specially-crafted entry line, which would result in a missing NULL terminator and cause CVS to crash.
Platforms Affected:
- CVS, Derek Price, CVS (Concurrent Versions System) 1.11.16 and prior
- CVS, Derek Price, CVS (Concurrent Versions System) 1.12.8 and prior
- Debian, Debian Linux 3.0
- FreeBSD, FreeBSD
- Gentoo, Linux
- MandrakeSoft, Mandrake Linux 10.0
- MandrakeSoft, Mandrake Linux 10.0 AMD64
- MandrakeSoft, Mandrake Linux 9.1
- MandrakeSoft, Mandrake Linux 9.1 PPC
- MandrakeSoft, Mandrake Linux 9.2
- MandrakeSoft, Mandrake Linux 9.2 AMD64
- MandrakeSoft, Mandrake Linux Corporate Server 2.1
- MandrakeSoft, Mandrake Linux Corporate Server 2.1 X86_64
- Novell, UnitedLinux 1.0
- OpenPKG, OpenPKG 1.3
- OpenPKG, OpenPKG 2.0
- OpenPKG, OpenPKG CURRENT
- RedHat, Enterprise Linux 2.1 AW
- RedHat, Enterprise Linux 2.1 WS
- RedHat, Enterprise Linux 2.1 AS
- RedHat, Enterprise Linux 2.1 ES
- RedHat, Enterprise Linux 3 ES
- RedHat, Enterprise Linux 3 AS
- RedHat, Enterprise Linux 3 Desktop
- RedHat, Enterprise Linux 3 WS
- RedHat, Linux Advanced Workstation 2.1 Itanium
- Slackware, Slackware Linux 8.1
- Slackware, Slackware Linux 9.0
- Slackware, Slackware Linux 9.1
- Slackware, Slackware Linux current
- SuSE, SuSE Linux 9.0
- SuSE, SuSE Linux Enterprise Server 7.0
- SuSE, SuSE Linux Office Server
Remedy:
Upgrade to the latest CVS package, as listed below. Refer to RHSA-2004:233-07 for more information. See References.
Red Hat Enterprise Linux AS (v. 2.1), ES (v. 2.1), WS (v. 2.1), and Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor: 1.11.1p1-16 or later
Red Hat Enterprise Linux AS (v. 3), ES (v. 3), WS (v. 3), Desktop: 1.11.2-24.x86_64 or later
For Debian GNU/Linux 3.0 (alias woody):
Upgrade to the latest cvs package (1.11.1p1debian-9woody6 or later), as listed in DSA-517-1. See References.
For Slackware Linux:
Upgrade to the latest cvs package, as listed below. Refer to slackware-security Mailing List, Wed, 9 Jun 2004 14:05:46 -0700 (PDT) for more information. See References.
Slackware Linux 8.1 and 9.0: 1.11.17-i386-1 or later
Slackware Linux 9.1 and -current: 1.11.17-i486 or later
For Mandrake Linux:
Upgrade to the latest cvs package, as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2004:058 : cvs for more information.See References.
Mandrake Linux 9.1: 1.11.16-1.1.91mdk or later
Mandrake Linux 9.2: 1.11.16-1.1.92mdk or later
Mandrake Linux Corporate Server 2.1: 1.11.16-1.1.C21mdk or later
Mandrake Linux 10.0: 1.11.16-1.1.100mdk or later
For Gentoo Linux:
Upgrade to the latest version of cvs (1.11.17 or later), as listed in GLSA 200406-06. See References.
For OpenPKG:
Upgrade to the latest cvs package, as listed in OpenPKG Security Advisory OpenPKG-SA-2004.027-cvs. See References.
OpenPKG CURRENT: 1.12.9-20040609 or later
OpenPKG 2.0: 1.12.5-2.0.3 or later
OpenPKG 1.3: 1.12.1-1.3.6 or later
For FreeBSD:
Upgrade to the latest version of cvs, as listed in FreeBSD Security Advisory FreeBSD-SA-04:14.cvs.asc. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Denial of Service
References:
- CIAC Information Bulletin O-156, Multiple Vulnerabilities in CVS at http://www.ciac.org/ciac/bulletins/o-156.shtml.
- CIAC Information Bulletin O-156, [CVS Newsfile Revision 1.116.2.104] at http://www.ciac.org/ciac/bulletins/o-156.shtml.
- CVS Web site, Project Download List at http://ccvs.cvshome.org/servlets/ProjectDownloadList.
- FreeBSD Security Advisory FreeBSD-SA-04:14.cvs.asc, cvs at ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:14.cvs.asc.
- Full-Disclosure Mailing List, Wed Jun 09 2004 - 08:00:04 CDT , Advisory 09/2004: More CVS remote vulnerabilities at http://archives.neohapsis.com/archives/fulldisclosure/2004-06/0215.html.
- GLSA 200406-06, CVS: additional DoS and arbitrary code execution at http://www.linuxsecurity.com/content/view/106164/104/.
- Slackware Security Advisories (SSA:2004-161-01), cvs at http://slackware.com/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.427370.
- BID-10499: CVS Multiple Vulnerabilities
- CVE-2004-0414: CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle malformed Entry lines, which prevents a NULL terminator from being used and may lead to a denial of service (crash), modification of critical program data, or arbitrary code execution.
- DSA-517: cvs -- buffer overflow
- GLSA-200406-06: CVS: additional DoS and arbitrary code execution vulnerabilities
- MDKSA-2004:058: Updated cvs packages fix multiple vulnerabilities
- OpenPKG-SA-2004.027: CVS
- RHSA-2004-233: cvs security update
- SUSE-SA:2004:015: cvs: remote command execution
Reported:
Jun 09, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net