Executive Summary
| Summary | |
|---|---|
| Title | multiple CVS improvements |
| Informations | |||
|---|---|---|---|
| Name | DSA-422 | First vendor Publication | 2004-01-13 |
| Vendor | Debian | Last vendor Modification | 2004-01-13 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| The account management of the CVS pserver (which is used to give remote access to CVS repositories) uses a CVSROOT/passwd file in each repository which contains the accounts and their authentication information as well as the name of the local unix account to use when a pserver account is used. Since CVS performed no checking on what unix account was specified anyone who could modify the CVSROOT/passwd could gain access to all local users on the CVS server, including root. This has been fixed in upstream version 1.11.11 by preventing pserver from running as root. For Debian this problem is solved in version 1.11.1p1debian-9 in two different ways: * pserver is no longer allowed to use root to access repositories * a new /etc/cvs-repouid is introduced which can be used by the system administrator to override the unix account used to access a repository. More information on this change can be found at http://www.wiggy.net/code/cvs-repouid/ Additionaly, CVS pserver had a bug in parsing module requests which could be used to create files and directories outside a repository. This has been fixed upstream in version 1.11.11 and Debian version 1.11.1p1debian-9 . Finally, the umask used for 'cvs init' and 'cvs-makerepos' has been changed to prevent repositories from being created with group write permissions. |
Original Source
| Url : http://www.debian.org/security/2004/dsa-422 |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:11528 | |||
| Oval ID: | oval:org.mitre.oval:def:11528 | ||
| Title: | CVS server before 1.11.10 may allow attackers to cause the CVS server to create directories and files in the file system root directory via malformed module requests. | ||
| Description: | CVS server before 1.11.10 may allow attackers to cause the CVS server to create directories and files in the file system root directory via malformed module requests. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2003-0977 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 | Product(s): | |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:855 | |||
| Oval ID: | oval:org.mitre.oval:def:855 | ||
| Title: | Red Hat CVS Server root Directory Access Vulnerability | ||
| Description: | CVS server before 1.11.10 may allow attackers to cause the CVS server to create directories and files in the file system root directory via malformed module requests. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2003-0977 | Version: | 2 |
| Platform(s): | Red Hat Linux 9 | Product(s): | CVS server |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:866 | |||
| Oval ID: | oval:org.mitre.oval:def:866 | ||
| Title: | Red Hat Enterprise 3 CVS Server root Directory Access Vulnerability | ||
| Description: | CVS server before 1.11.10 may allow attackers to cause the CVS server to create directories and files in the file system root directory via malformed module requests. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2003-0977 | Version: | 2 |
| Platform(s): | Red Hat Enterprise Linux 3 | Product(s): | CVS server |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200312-04 (CVS) File : nvt/glsa_200312_04.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 422-1 (cvs) File : nvt/deb_422_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 2941 | CVS pserver Crafted Module Request Arbitrary File / Directory Creation CVS contains a flaw that allows a remote attacker to create arbitrary files and directories on a vulnerable server. This is due to CVS not checking attempts to create files or directories. |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-01-10 | CVS non-relative path access attempt RuleID : 2318-community - Revision : 8 - Type : SERVER-OTHER |
| 2014-01-10 | CVS non-relative path access attempt RuleID : 2318 - Revision : 8 - Type : SERVER-OTHER |
| 2014-01-10 | CVS non-relative path error response RuleID : 2317-community - Revision : 10 - Type : INDICATOR-COMPROMISE |
| 2014-01-10 | CVS non-relative path error response RuleID : 2317 - Revision : 10 - Type : INDICATOR-COMPROMISE |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2004-09-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-422.nasl - Type : ACT_GATHER_INFO |
| 2004-07-31 | Name : The remote Mandrake Linux host is missing a security update. File : mandrake_MDKSA-2003-112.nasl - Type : ACT_GATHER_INFO |
| 2004-07-06 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2004-004.nasl - Type : ACT_GATHER_INFO |
| 2003-12-11 | Name : The revision control service running on the remote host has an arbitrary file... File : cvs_dir_create.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:33:01 |
|
