PT-2004-1090 · Cvs · Cvs

Derek Price · Published 2004-04-14 · Updated 2017-10-11 · CVE-2004-0405

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions CVS versions prior to 1.11.14

Description The issue allows attackers to read arbitrary files via .. (dot dot) sequences in filenames via CVS client requests. This can lead to a breach of confidentiality of protected information. Exploitation of the issue can be done remotely.

Recommendations For versions prior to 1.11.14, update to version 1.11.14 or later to resolve the issue. As a temporary workaround, consider restricting access to the CVS client requests to minimize the risk of exploitation.

Fix

Related Identifiers

BDU:2015-09449

CVE-2004-0405

DSA-486

RHSA-2004:153

Affected Products

Cvs

References · 14

• https://osv.dev/vulnerability/DEBIAN-CVE-2004-0405 · Vendor Advisory
• http://slackware.com/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.400181 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200404-13.xml · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2004-0405 · Vendor Advisory
• ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:07.cvs.asc · Vendor Advisory
• http://debian.org/security/2004/dsa-486 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2004-0405 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09449 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2004-0405 · Security Note
• ftp://patches.sgi.com/support/free/security/advisories/20040404-01-U.asc · Vendor Advisory
• http://marc.info/?l=bugtraq&m=108636445031613&w=2 · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10818 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1060 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15891 · Note