PT-2004-1090 · Cvs · Cvs

Derek Price · Publicado 2004-04-14 · Atualizado 2017-10-11 · CVE-2004-0405

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions CVS versions prior to 1.11.14

Description The issue allows attackers to read arbitrary files via .. (dot dot) sequences in filenames via CVS client requests. This can lead to a breach of confidentiality of protected information. Exploitation of the issue can be done remotely.

Recommendations For versions prior to 1.11.14, update to version 1.11.14 or later to resolve the issue. As a temporary workaround, consider restricting access to the CVS client requests to minimize the risk of exploitation.

Correção

Identificadores relacionados

BDU:2015-09449

CVE-2004-0405

DSA-486

RHSA-2004:153

Produtos afetados

Cvs

Referências · 14

• https://osv.dev/vulnerability/DEBIAN-CVE-2004-0405 · Aviso do Fabricante
• http://slackware.com/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.400181 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10818 · Nota
• http://security.gentoo.org/glsa/glsa-200404-13.xml · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2004-0405 · Aviso do Fabricante
• ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:07.cvs.asc · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1060 · Nota
• http://debian.org/security/2004/dsa-486 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2004-0405 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-09449 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2004-0405 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15891 · Nota
• ftp://patches.sgi.com/support/free/security/advisories/20040404-01-U.asc · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=108636445031613&w=2 · Aviso do Fabricante