CVSTrac allows command execution
| cvstrac-command-execute (16929) |  High Risk |
Description:
CVSTrac could allow a remote attacker to execute arbitrary commands, caused by improper validation of user-supplied input. A remote attacker could send a specially-crafted request containing commands that would be executed on the vulnerable system.
Platforms Affected:
- Open Source, CVSTrac 1.1.3
- OpenPKG, OpenPKG 2.0
- OpenPKG, OpenPKG 2.1
- OpenPKG, OpenPKG CURRENT
Remedy:
For OpenPKG:
Upgrade to the latest cvstrac package, as listed in OpenPKG Security Advisory OpenPKG-SA-2004.036. See References.
OpenPKG CURRENT:1.1.3-20040806 or later
OpenPKG 2.1: 1.1.3-2.1.1 or later
OpenPKG 2.0: 1.1.2-2.0.1 or later
Consequences:
Gain Access
References:
- BugTraq Mailing List, Thu Aug 05 2004 - 12:57:09 CDT , CVStrac Remote Arbitrary Code Execution exploit at http://archives.neohapsis.com/archives/bugtraq/2004-08/0054.html.
- CVSTrac Web site, CVSTrac - A Web-Based Bug And Patch-Set Tracking System at http://www.cvstrac.org/.
- BID-10878: CVSTrac filediff Remote Command Execution Vulnerability
- CVE-2004-1456: filediff in CVStrac allows remote attackers to execute arbitrary commands via shell metacharacters in rcsinfo.
- OpenPKG-SA-2004.036: CVSTrac
- OSVDB ID: 8373: CVSTrac filediff Arbitrary Remote Code Execution
- SA12090: CVSTrac "filediff" Arbitrary Command Execution Vulnerability
- SUSE-SR:2005:014: SUSE Security Summary Report
- US-CERT VU#770816: CVSTrac fails to properly sanitize input passed to filediff
Reported:
Aug 05, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net