BID:9306

CVS PServer CVSROOT Passwd File Privileged Arbitrary Code Execution Vulnerability

Info

CVS PServer CVSROOT Passwd File Privileged Arbitrary Code Execution Vulnerability

Bugtraq ID:	9306
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Dec 18 2003 12:00AM
Updated:	Dec 18 2003 12:00AM
Credit:	This vulnerability was announced by the vendor.
Vulnerable:	CVS CVS 1.11.10 CVS CVS 1.11.6 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 CVS CVS 1.11.5 + OpenPKG OpenPKG 1.2 + S.u.S.E. Linux Personal 8.2 CVS CVS 1.11.4 CVS CVS 1.11.3 CVS CVS 1.11.2 + Mandriva Linux Mandrake 9.0 + Redhat Linux 8.0 i386 + Redhat Linux 8.0 + Slackware Linux 8.1 CVS CVS 1.11.1 p1 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 + OpenBSD OpenBSD 3.5 + OpenBSD OpenBSD 3.4 + OpenBSD OpenBSD 3.3 + OpenBSD OpenBSD 3.2 + OpenBSD OpenBSD 3.1 + Redhat Linux 7.3 i386 + Redhat Linux 7.3 + Redhat Linux 7.2 ia64 + Redhat Linux 7.2 i386 + Redhat Linux 7.2 alpha + Redhat Linux 7.2 + Redhat Linux 7.1 ia64 + Redhat Linux 7.1 i386 + Redhat Linux 7.1 alpha + Redhat Linux 7.1 + Redhat Linux 7.0 sparc + Redhat Linux 7.0 i386 + Redhat Linux 7.0 alpha + Redhat Linux 7.0 + Redhat Linux 6.2 sparc + Redhat Linux 6.2 i386 + Redhat Linux 6.2 + SuSE Linux 8.1 + SuSE Linux 8.0 + Wirex Immunix OS 7.0 + Wirex Immunix OS 7+ CVS CVS 1.11.1 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 + Mandriva Linux Mandrake 8.2 ppc + Mandriva Linux Mandrake 8.2 + Mandriva Linux Mandrake 8.1 ia64 + Mandriva Linux Mandrake 8.1 CVS CVS 1.11 + Caldera OpenLinux Server 3.1.1 + Caldera OpenLinux Server 3.1 + Caldera OpenLinux Workstation 3.1.1 + Caldera OpenLinux Workstation 3.1 + Mandriva Linux Mandrake 8.0 ppc + Mandriva Linux Mandrake 8.0 CVS CVS 1.10.8 + MandrakeSoft Single Network Firewall 7.2 + Mandriva Linux Mandrake 7.2 CVS CVS 1.10.7 + Debian Linux 2.2 sparc + Debian Linux 2.2 powerpc + Debian Linux 2.2 IA-32 + Debian Linux 2.2 arm + Debian Linux 2.2 alpha + Debian Linux 2.2 68k + Debian Linux 2.2

Not Vulnerable:	CVS CVS 1.11.11

Discussion

CVS PServer CVSROOT Passwd File Privileged Arbitrary Code Execution Vulnerability

CVS versions prior to 1.11.11 that are configured to run with pserver access enabled, have been reported prone to an arbitrary code execution vulnerability. The vulnerability may be exploitable by users with specific access levels.

CVS vendors have released a security update. This update supposedly drops root privileges after a user login, to prevent potential privileged code execution.

Exploit / POC

CVS PServer CVSROOT Passwd File Privileged Arbitrary Code Execution Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

CVS PServer CVSROOT Passwd File Privileged Arbitrary Code Execution Vulnerability

Solution:
The vendor has released an update to address this issue.

Gentoo Linux have advised (200312-08) that all Gentoo Linux users with CVS installed should update their systems to use cvs-1.11.11 or higher. This can be accomplished by issuing the following commands:

emerge sync
emerge -pv '>=dev-util/cvs-1.11.11'
emerge '>=dev-util/cvs-1.11.11'
emerge clean

CVS CVS 1.10.7