ViewVC Versions Prior to 1.1.3 Multiple Remote Vulnerabilities

Bugtraq ID:	37518
Class:	Unknown
CVE:
Remote:	Yes
Local:	Yes
Published:	Dec 29 2009 12:00AM
Updated:	Dec 30 2009 08:32PM
Credit:	Reported by the vendor
Vulnerable:	ViewVC ViewVC 1.1.2 ViewVC ViewVC 1.0.9 ViewVC ViewVC 1.0.8 ViewVC ViewVC 1.0.5 ViewVC ViewVC 1.0.3 ViewVC ViewVC 1.0.2 Red Hat Fedora 12 Red Hat Fedora 11
Not Vulnerable:	ViewVC ViewVC 1.1.3

ViewVC Versions Prior to 1.1.3 Multiple Remote Vulnerabilities

ViewVC is prone to these security vulnerabilities:

- A security vulnerability that involves root listing of per-root authorization configuration.
- A security vulnerability in 'query.py' involving the 'forbidden' authorizer (or none).

Very little information is known about these issues. We will update this BID as soon as more information emerges.

Versions prior to ViewVC 1.1.3 are vulnerable.

ViewVC Versions Prior to 1.1.3 Multiple Remote Vulnerabilities

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

ViewVC Versions Prior to 1.1.3 Multiple Remote Vulnerabilities

Solution:
Vendor updates are available. Please see the references for details.

ViewVC Versions Prior to 1.1.3 Multiple Remote Vulnerabilities

References:

• ViewVC Changelog (ViewVC)
  
• ViewVC Tigris Homepage (ViewVC)