ViewVC Multiple Remote Information Disclosure Vulnerabilities

Bugtraq ID:	28055
Class:	Access Validation Error
CVE:	CVE-2008-1290 CVE-2008-1291 CVE-2008-1292
Remote:	Yes
Local:	No
Published:	Feb 29 2008 12:00AM
Updated:	Apr 13 2015 09:54PM
Credit:	The vendor disclosed these issues.
Vulnerable:	ViewVC ViewVC 1.0.3 ViewVC ViewVC 1.0.2 Redhat Fedora 7 Gentoo Linux
Not Vulnerable:	ViewVC ViewVC 1.0.5

ViewVC Multiple Remote Information Disclosure Vulnerabilities

ViewVC is prone to multiple information-disclosure vulnerabilities because the application fails to properly validate user privileges.

An unprivileged attacker may exploit these issues to bypass certain security restrictions and gain access to perform certain actions that will disclose sensitive information.

These issues affect versions prior to ViewVC 1.0.5.

ViewVC Multiple Remote Information Disclosure Vulnerabilities

Attackers can use a browser to exploit these issues.

ViewVC Multiple Remote Information Disclosure Vulnerabilities

Solution:
The vendor has released ViewVC 1.0.5 to address these issues. Please see the references for more information.


ViewVC ViewVC 1.0.2

• ViewVC viewvc-1.0.5.tar.gz
  http://viewvc.tigris.org/files/documents/3330/41694/viewvc-1.0.5.tar.g z

ViewVC ViewVC 1.0.3

• ViewVC viewvc-1.0.5.tar.gz
  http://viewvc.tigris.org/files/documents/3330/41694/viewvc-1.0.5.tar.g z

ViewVC Multiple Remote Information Disclosure Vulnerabilities

References:

• ViewVC Changelog (ViewVC)
  
• ViewVC Tigris Homepage (ViewVC)