CVS Server Global Variable Denial Of Service Vulnerability
BID:4234
Info
CVS Server Global Variable Denial Of Service Vulnerability
| Bugtraq ID: | 4234 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 05 2002 12:00AM |
| Updated: | Mar 05 2002 12:00AM |
| Credit: | The discovery of this vulnerability is credited to Kim Nielsen. |
| Vulnerable: |
CVS Kit CVS Server 1.10.7 |
| Not Vulnerable: |
CVS Kit CVS Server 1.11.1 p1 CVS Kit CVS Server 1.10 .8 |
Discussion
CVS Server Global Variable Denial Of Service Vulnerability
CVS Server is a freely available, open source software package designed for the management and distribution of source code. It is available for the Microsoft Windows, Linux and Unix platforms.
Due to a programming error, a global variable used by the CVS Server program is improperly initialized. Because of this, a remote user may be able to create a set of circumstances that use the improperly initialized variable. This could result in the server reacting unpredictably, and crashing.
CVS Server is a freely available, open source software package designed for the management and distribution of source code. It is available for the Microsoft Windows, Linux and Unix platforms.
Due to a programming error, a global variable used by the CVS Server program is improperly initialized. Because of this, a remote user may be able to create a set of circumstances that use the improperly initialized variable. This could result in the server reacting unpredictably, and crashing.
Exploit / POC
CVS Server Global Variable Denial Of Service Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
CVS Server Global Variable Denial Of Service Vulnerability
Solution:
This issue was addressed in versions 1.10.8 and later. Users are advised to upgrade.
Upgrades are available. Red Hat packages have been made available which also address another unrelated vulnerability (BugTraq ID 4267 "ZLib Compression Library Heap Corruption Vulnerability").
CVS Kit CVS Server 1.10.7
Solution:
This issue was addressed in versions 1.10.8 and later. Users are advised to upgrade.
Upgrades are available. Red Hat packages have been made available which also address another unrelated vulnerability (BugTraq ID 4267 "ZLib Compression Library Heap Corruption Vulnerability").
CVS Kit CVS Server 1.10.7
-
CVSHome cvs-1.11.1p1.tar.gz
http://ccvs.cvshome.org/servlets/ProjectDownloadList?action=download&d lID=41 -
Debian cvs-doc_1.10.7-9_all.deb
http://security.debian.org/dists/stable/updates/main/binary-all/cvs-do c_1.10.7-9_all.deb -
Debian cvs_1.10.7-9_alpha.deb
http://security.debian.org/dists/stable/updates/main/binary-alpha/cvs_ 1.10.7-9_alpha.deb -
Debian cvs_1.10.7-9_arm.deb
http://security.debian.org/dists/stable/updates/main/binary-arm/cvs_1. 10.7-9_arm.deb -
Debian cvs_1.10.7-9_i386.deb
http://security.debian.org/dists/stable/updates/main/binary-i386/cvs_1 .10.7-9_i386.deb -
Debian cvs_1.10.7-9_m68k.deb
http://security.debian.org/dists/stable/updates/main/binary-m68k/cvs_1 .10.7-9_m68k.deb -
Debian cvs_1.10.7-9_powerpc.deb
http://security.debian.org/dists/stable/updates/main/binary-powerpc/cv s_1.10.7-9_powerpc.deb -
Debian cvs_1.10.7-9_sparc.deb
http://security.debian.org/dists/stable/updates/main/binary-sparc/cvs_ 1.10.7-9_sparc.deb -
Red Hat cvs-1.11.1p1-6.2.src.rpm
Source RPM.
ftp://updates.redhat.com/6.2/en/os/SRPMS/cvs-1.11.1p1-6.2.src.rpm -
Red Hat cvs-1.11.1p1-7.alpha.rpm
ftp://updates.redhat.com/7.0/en/os/alpha/cvs-1.11.1p1-7.alpha.rpm -
Red Hat cvs-1.11.1p1-7.alpha.rpm
ftp://updates.redhat.com/7.1/en/os/alpha/cvs-1.11.1p1-7.alpha.rpm -
Red Hat cvs-1.11.1p1-7.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/cvs-1.11.1p1-7.i386.rpm -
Red Hat cvs-1.11.1p1-7.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/cvs-1.11.1p1-7.i386.rpm -
Red Hat cvs-1.11.1p1-7.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/cvs-1.11.1p1-7.i386.rpm -
Red Hat cvs-1.11.1p1-7.ia64.rpm
ftp://updates.redhat.com/7.1/en/os/ia64/cvs-1.11.1p1-7.ia64.rpm -
Red Hat cvs-1.11.1p1-7.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/cvs-1.11.1p1-7.ia64.rpm -
Red Hat cvs-1.11.1p1-7.src.rpm
Source RPM.
ftp://updates.redhat.com/7.0/en/os/SRPMS/cvs-1.11.1p1-7.src.rpm -
Red Hat cvs-1.11.1p1-7.src.rpm
Source RPM.
ftp://updates.redhat.com/7.1/en/os/SRPMS/cvs-1.11.1p1-7.src.rpm -
Red Hat cvs-1.11.1p1-7.src.rpm
Source RPM.
ftp://updates.redhat.com/7.2/en/os/SRPMS/cvs-1.11.1p1-7.src.rpm
References
CVS Server Global Variable Denial Of Service Vulnerability
References:
References: