PT-2000-1613 · Concurrent Versions System · Cvs

Published 2000-10-20 · Updated 2008-09-05 · CVE-2000-0680

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CVS version 1.10.8

Description The issue allows remote CVS committers to create or modify Trojan horse programs by exploiting improper restrictions on creating arbitrary Checkin.prog or Update.prog programs. This can be achieved by performing a CVS commit action, potentially leading to malicious modifications.

Recommendations For CVS version 1.10.8, restrict access to the Checkin.prog and Update.prog programs to prevent unauthorized modifications, and consider implementing additional access controls to limit the actions of remote CVS committers.

Exploit

Fix

Related Identifiers

CVE-2000-0680

Affected Products

Cvs

References · 4

• 🔥 https://exploit-db.com/exploits/20108 · Exploit
• 🔥 http://securityfocus.com/bid/1524 · Exploit
• 🔥 http://securityfocus.com/frames/?content=/templates/archive.pike%3Flist%3D1%26msg%3Dhvou2daoebb.fsf%40serein.m17n.org · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2000-0680 · Security Note