PT-2004-1852 · Cvs · Cvs

Published 2004-08-18 · Updated 2024-02-14 · CVE-2004-0778

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions CVS versions 1.11.x through 1.11.16 CVS versions 1.12.x through 1.12.8

Description The issue allows remote attackers to determine the existence of arbitrary files and directories. This is achieved via the -X command for an alternate history file, which causes different error messages to be returned, thus revealing the presence of specific files or directories.

Recommendations For CVS versions 1.11.x through 1.11.16, update to version 1.11.17 or later. For CVS versions 1.12.x through 1.12.8, update to version 1.12.9 or later.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2004-0778

RHSA-2004:233

Affected Products

Cvs

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2004-0778 · Security Note
• http://mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:108 · Vendor Advisory
• http://idefense.com/application/poi/display?id=130&type=vulnerabilities · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2004-0778 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-0778 · Vendor Advisory
• http://securityfocus.com/bid/10955 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2004-0778 · Vendor Advisory
• http://kb.cert.org/vuls/id/579225 · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17001 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10688 · Note