PT-2004-1556 · Cvs · Cvs

Sebastian Krahmer + 1 · Published 2004-06-11 · Updated 2018-05-03 · CVE-2004-0417

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions CVS versions 1.11.x through 1.11.16 CVS versions 1.12.x through 1.12.8

Description The issue is related to an integer overflow in the serve max dotdot command for the CVS protocol, which may allow remote attackers to cause a server crash. This could lead to temporary data remaining undeleted and consuming disk space.

Recommendations For CVS versions 1.11.x through 1.11.16, update to a version outside of this range to resolve the issue. For CVS versions 1.12.x through 1.12.8, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the serve max dotdot command to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2004-0417

DSA-519

RHSA-2004:233

Affected Products

Cvs

References · 14

• ftp://patches.sgi.com/support/free/security/advisories/20040605-01-U.asc · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-0417 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0417 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2004-0417 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2004-0417 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200406-06.xml · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-233.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2004:058 · Vendor Advisory
• http://debian.org/security/2004/dsa-519 · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1001 · Note
• http://security.e-matters.de/advisories/092004.html · Note
• http://marc.info/?l=bugtraq&m=108716553923643&w=2 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11145 · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2004-June/022441.html · Note