CVS "history" command may disclose sensitive information

Overview

A vulnerability exists in the history command of Concurrent Versions System (CVS). If exploited, this vulnerability could disclose sensitive information about files and directories on an affected system to a remote, authenticated CVS user.

Description

Concurrent Versions System (CVS) is a source code maintenance system that is widely used by open-source software development projects. It provides a history command that displays reports on cvs commands that have been executed on files or directories in the source repository. The history command supports a -X command line switch, which is designed to allow a user to specify the name of the history file to be used. This command line switch contains an information disclosure vulnerability. When specifying a directory or filename to the -X command line switch, the error message that is returned could allow an attacker to determine the existence and accessibility of arbitrary files or directories on an affected system.

---

Impact

A remote, authenticated CVS user could determine if arbitrary files or directories exist on an affected system and whether the CVS daemon has privileges to access them.

---

Solution

Apply a patch or upgrade

Apply the appropriate patch or upgrade as specified by your vendor. This issue has been resolved in Stable CVS Version 1.11.17 and CVS Feature Version 1.12.9.

---

Disable the CVS server

Until patches are available and can be applied, consider disabling the CVS server.
**
Block or restrict access**

Block or restrict access to the CVS server from untrusted hosts and networks. The CVS server typically listens on 2401/tcp, but it may use another port or protocol.
**
Limit the CVS server privileges**

* Configure CVS server to run in a restricted (chroot) environment.
* Run CVS servers with the minimum set of privileges required on the host file system.
* Provide separate systems for development (write) and public/anonymous (read-only) CVS access.
* Host public/anonymous CVS servers on single-purpose, secured systems.

Note that some of these workarounds will only limit the scope and impact of possible attacks.

Vendor Information

579225

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

CVS Home Affected

Updated: August 18, 2004

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23579225 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• http://www.idefense.com/application/poi/display?id=130&type=vulnerabilities
• <http://www.securitytracker.com/alerts/2004/Aug/1010958.html&gt;
• <http://secunia.com/advisories/12309/&gt;

Acknowledgements

This vulnerability was reported by iDefense.

This document was written by Damon Morda.

Other Information

CVE IDs:	CVE-2004-0778
Severity Metric:	12.60 Date Public: