Date: Tue, 22 Mar 2005 16:57:08 -0500
From: Derek Price <derek@ximbiot.com>
To: vendor-sec@lst.de, Mark D. Baushke <mdb@cvshome.org>,
    Larry Jones <lawrence.jones@ugs.com>
Subject: [vendor-sec] New CVS Vulnerabilities
Parts/Attachments:
   1.1 Shown     48 lines  Text
   1.2 Shown    122 lines  Text
   1.3           97 KB     Application
   2            261 bytes  Application, "OpenPGP digital signature"
----------------------------------------

Hi all,

Alen Zukich <alen.zukich@klocwork.com> sent me an in-depth defect
analysis of the CVS sources, which I assume was generated by some sort
of automated tool his company sells.

Anyhow, most of the "defects" he reported were non-existant, simple
memory leaks, or harmless, but several might be exploitable.  I expect
that the buffer overflow almost certainly is, though I haven't attempted
it myself.  I've attached the patch for the problems I thought might be
exploitable.

None of these fixes have CVE #s.  This is probably the first anyone
besides myself and Alen (and maybe other folks at Klocwork) have heard
the specifics.

I have also attached a copy of Alen's analysis for anyone who would like
to review them and my responses.  I've attached it as an Open Office 1.0
Text document since the file size is better than 1/10th of the original
MS Word document, but I can send the original MS Word to whoever needs
it.  Except for the four changes contained in the attached patch,
anything that I noted as "committed" in my annotations of the analysis
have been committed to either the 1.11.19.1 or 1.12.11.1 CVS sources.

I could probably release on fairly short notice.  CVS 1.11.19.1 isn't
compiling on an HP-UX and a Solaris but we should be able to fix that
shortly.  Any time 2 weeks from now to 1 month from now would be fine by
me for a coordinated release.

Actionable items:

  1.

     I'd appreciate a code review.

  2.

     The attached patch wants at least one CVE #.

  3.

     Agree on a release schedule.


Regards,

Derek