National Cyber Awareness System

Vulnerability Summary for CVE-2004-0396

Overview

Heap-based buffer overflow in CVS 1.11.x up to 1.11.15, and 1.12.x up to 1.12.7, when using the pserver mechanism allows remote attackers to execute arbitrary code via Entry lines.

Impact

CVSS Severity (version 2.0 incomplete approximation):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Vulnerability Note: VU#192038

Name: VU#192038

Type: Advisory; Patch Information

Hyperlink:http://www.kb.cert.org/vuls/id/192038

US-CERT Technical Alert: TA04-147A

Name: TA04-147A

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA04-147A.html

External Source: REDHAT

Name: RHSA-2004:190

Type: Advisory; Patch Information

Hyperlink:http://www.redhat.com/support/errata/RHSA-2004-190.html

External Source: DEBIAN

Name: DSA-505

Type: Advisory; Patch Information

Hyperlink:http://www.debian.org/security/2004/dsa-505

External Source: BUGTRAQ

Name: 20040519 Advisory 07/2004: CVS remote vulnerability

Type: Advisory; Patch Information

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=108498454829020&w=2

External Source: GENTOO

Name: GLSA-200405-12

Hyperlink:http://security.gentoo.org/glsa/glsa-200405-12.xml

External Source: MISC

Name: http://security.e-matters.de/advisories/072004.html

Hyperlink:http://security.e-matters.de/advisories/072004.html

External Source: OVAL

Name: oval:org.mitre.oval:def:9058

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9058

External Source: SUSE

Name: SuSE-SA:2004:013

Hyperlink:http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/021742.html

External Source: NETBSD

Name: NetBSD-SA2004-008

Hyperlink:ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2004-008.txt.asc

External Source: FREEBSD

Name: FreeBSD-SA-04:10

Hyperlink:ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:10.cvs.asc

External Source: XF

Name: cvs-entry-line-bo(16193)

Hyperlink:http://xforce.iss.net/xforce/xfdb/16193

External Source: SLACKWARE

Name: SSA:2004-140-01

Hyperlink:http://www.slackware.com/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.395865

External Source: BID

Name: 10384

Hyperlink:http://www.securityfocus.com/bid/10384

External Source: OSVDB

Name: 6305

Hyperlink:http://www.osvdb.org/6305

External Source: MANDRAKE

Name: MDKSA-2004:048

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2004:048

External Source: CIAC

Name: O-147

Hyperlink:http://www.ciac.org/ciac/bulletins/o-147.shtml

External Source: SECUNIA

Name: 11674

Hyperlink:http://secunia.com/advisories/11674

External Source: SECUNIA

Name: 11652

Hyperlink:http://secunia.com/advisories/11652

External Source: SECUNIA

Name: 11651

Hyperlink:http://secunia.com/advisories/11651

External Source: SECUNIA

Name: 11647

Hyperlink:http://secunia.com/advisories/11647

External Source: SECUNIA

Name: 11641

Hyperlink:http://secunia.com/advisories/11641

External Source: OPENBSD

Name: 20040520 cvs server buffer overflow vulnerability

Hyperlink:http://marc.theaimsgroup.com/?l=openbsd-security-announce&m=108508894405639&w=2

External Source: FEDORA

Name: FEDORA-2004-1620

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=108636445031613&w=2

External Source: BUGTRAQ

Name: 20040519 [OpenPKG-SA-2004.022] OpenPKG Security Advisory (cvs)

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=108500040719512&w=2

External Source: BUGTRAQ

Name: 20040519 Advisory 07/2004: CVS remote vulnerability

Hyperlink:http://cert.uni-stuttgart.de/archive/bugtraq/2004/05/msg00219.html

External Source: FULLDISC

Name: 20040519 Advisory 07/2004: CVS remote vulnerability

Hyperlink:http://archives.neohapsis.com/archives/fulldisclosure/2004-05/0980.html

US Government Resource: oval:org.mitre.oval:def:970

Name: oval:org.mitre.oval:def:970

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:970

References to Check Content

Identifier:oval:org.mitre.oval:def:970

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:970

Identifier:oval:org.mitre.oval:def:9058

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:9058