OSVDB ID: 6833

Title: CVS Argumentx Arbitrary Command Execution

Info

Disclosure
Jun 09, 2004

Discovery
Unknown

Dates

Exploit
Unknown

Solution
Unknown

Description

 CVS (Concurrent Versions System) contains a flaw that may allow a malicious user to execude code remotely. The issue is triggered when an Argumentx command is issued which is used to add more data to a previously stored argument which is freed on client exit without checking if this list is already empty. This flaw, known as Double-free allows remote code executing resulting in a loss of integrity.

Classification

 Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Disclosure: OSVDB Verified

Solution

 Upgrade to version 1.11.17 or higher if using stable, feature version 1.12.9 or higher as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

CVS

CVS Feature Release

 1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8

CVS Stable Release

 1.11
1.11.1
1.11.10
1.11.11
1.11.12
1.11.13
1.11.14
1.11.15
1.11.16
1.11.1p1
1.11.2
1.11.3
1.11.4
1.11.5
1.11.6
1.11.7
1.11.8
1.11.9

References

Credit
  • Sebastian Krahmer - krahmersuse.de - SuSE
  • Stefan Esser - sesserhardened-php.net - www.hardened-php.net


Direct URL: http://osvdb.org/36218