Bug 51659 (CVE-2004-0180) - VUL-0: CVE-2004-0180: CVS pserver client side exploit
Summary: VUL-0: CVE-2004-0180: CVS pserver client side exploit
Status: RESOLVED FIXED
Alias: CVE-2004-0180
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: All Linux
: P3 - Medium : Major
Target Milestone: ---
Assignee: Adrian Schröter
QA Contact: Security Team bot
URL:
Whiteboard: CVE-2004-0180: CVSS v2 Base Score: 2....
Keywords:
Depends on:
Blocks:
 
Reported: 2004-03-22 17:38 UTC by Sebastian Krahmer
Modified: 2021-10-09 08:33 UTC (History)
1 user (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
the fix ffrom Derek (10.52 KB, patch)
2004-03-22 17:44 UTC, Sebastian Krahmer 		Details | Diff
The patch. "backported" (1.03 KB, patch)
2004-04-05 18:07 UTC, Sebastian Krahmer 		Details | Diff
2nd necessary patch (672 bytes, patch)
2004-04-05 18:08 UTC, Sebastian Krahmer 		Details | Diff
patchfile (550 bytes, application/octet-stream)
2004-04-12 18:13 UTC, Sebastian Krahmer 		Details
patchfile for box (609 bytes, application/octet-stream)
2004-04-12 18:13 UTC, Sebastian Krahmer 		Details
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sebastian Krahmer 2004-03-22 17:38:26 UTC 
CVS client accepts absolute pathnames during co/update. This allows for
"updating" arbitrary files such as /root/.bashrc.

CAN-2004-0180 has been assigned.
I will attach a fix from CVS boss.
Comment 1 Sebastian Krahmer 2004-03-22 17:38:26 UTC 
<!-- SBZ_reproduce  -->
Exploit exists. If you need it for testing I will send
it to you.
Comment 2 Sebastian Krahmer 2004-03-22 17:44:04 UTC 
Created attachment 16953 [details]
the fix ffrom Derek
Comment 3 Adrian Schröter 2004-03-22 17:58:24 UTC 
patch is submitted to STABLE. 
 
Are all versions affected ?
Comment 4 Sebastian Krahmer 2004-03-22 18:00:54 UTC 
Yes, so far I know.
Do you need patchinfos?
Comment 5 Adrian Schröter 2004-03-22 18:07:25 UTC 
can we postpone the fixes for older release after 9.1 Master ? 
 
patchinfos are not the problem, but the 9.0 already contains a version, where 
patched code not exists at all. I don't think I can do this within a day ..
Comment 6 Sebastian Krahmer 2004-03-22 18:14:23 UTC 
Um, I am not sure I understand you correctly. The patch applies clean
to SL 8.0, 8.1, 8.2? But not to Sl 9.0 and 9.1 correct?
Comment 7 Adrian Schröter 2004-03-22 18:18:13 UTC 
I only checked 9.1 and 9.0 yet. no problem with 9.1, but 9.0 already needs 
some more work. the patched code does not exist at all there and I need to 
understand what it is doing at all. (insert $FLAME_ABOUT_SPAGETTI_CODE). 
 
8.x will be much more work, I am sure.
Comment 8 Sebastian Krahmer 2004-03-22 21:17:55 UTC 
The function to patch in client.c is still there:
call_in_directory(). And it makes sense to me. import.c however is missing
the cp == checks which the patch substitutes.
I will ask the author whether import.c needs fixing in earlier versions.
Comment 9 Sebastian Krahmer 2004-04-05 18:07:52 UTC 
Created attachment 17910 [details]
The patch. "backported"

I removed all the sanity.sh and import.c changes since they are not necessary.
This one applied clean to 1.11.6, so I think it should not be a problem
to fix old boxes now. I will attach a second fix from Derek too,
which fixes some module bug. I also tried this one and it also
applies to older versions. With some line-offset :-)
Comment 10 Sebastian Krahmer 2004-04-05 18:08:23 UTC 
Created attachment 17911 [details]
2nd necessary patch

...
Comment 11 Adrian Schröter 2004-04-08 00:02:05 UTC 
thank you a lot. 
 
all packages have been submitted. 
closing this bug or reassign ?
Comment 12 Sebastian Krahmer 2004-04-09 17:11:20 UTC 
No, please leave open. We need it for tracking.
Comment 13 Sebastian Krahmer 2004-04-09 17:15:37 UTC 
I think there are patchinfo files missing. I will create them on monday,
as I think it will be useless today.
Comment 14 Sebastian Krahmer 2004-04-12 18:13:21 UTC 
Created attachment 18205 [details]
patchfile

...
Comment 15 Sebastian Krahmer 2004-04-12 18:13:51 UTC 
Created attachment 18206 [details]
patchfile for box

...
Comment 16 Sebastian Krahmer 2004-04-15 00:00:01 UTC 
Packages have been approved and announced.
Comment 17 Thomas Biege 2009-10-13 20:18:32 UTC 
CVE-2004-0180: CVSS v2 Base Score: 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N)