Bug 51659 - (CVE-2004-0180) VUL-0: CVE-2004-0180: CVS pserver client side exploit
(CVE-2004-0180)
VUL-0: CVE-2004-0180: CVS pserver client side exploit
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
All Linux
: P3 - Medium : Major
: ---
Assigned To: Adrian Schröter
Security Team bot
CVE-2004-0180: CVSS v2 Base Score: 2....
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2004-03-22 17:38 UTC by Sebastian Krahmer
Modified: 2021-10-09 08:33 UTC (History)
1 user (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
the fix ffrom Derek (10.52 KB, patch)
2004-03-22 17:44 UTC, Sebastian Krahmer
Details | Diff
The patch. "backported" (1.03 KB, patch)
2004-04-05 18:07 UTC, Sebastian Krahmer
Details | Diff
2nd necessary patch (672 bytes, patch)
2004-04-05 18:08 UTC, Sebastian Krahmer
Details | Diff
patchfile (550 bytes, application/octet-stream)
2004-04-12 18:13 UTC, Sebastian Krahmer
Details
patchfile for box (609 bytes, application/octet-stream)
2004-04-12 18:13 UTC, Sebastian Krahmer
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Sebastian Krahmer 2004-03-22 17:38:26 UTC
CVS client accepts absolute pathnames during co/update. This allows for
"updating" arbitrary files such as /root/.bashrc.

CAN-2004-0180 has been assigned.
I will attach a fix from CVS boss.
Comment 1 Sebastian Krahmer 2004-03-22 17:38:26 UTC
<!-- SBZ_reproduce  -->
Exploit exists. If you need it for testing I will send
it to you.
Comment 2 Sebastian Krahmer 2004-03-22 17:44:04 UTC
Created attachment 16953 [details]
the fix ffrom Derek
Comment 3 Adrian Schröter 2004-03-22 17:58:24 UTC
patch is submitted to STABLE. 
 
Are all versions affected ? 
Comment 4 Sebastian Krahmer 2004-03-22 18:00:54 UTC
Yes, so far I know.
Do you need patchinfos?
Comment 5 Adrian Schröter 2004-03-22 18:07:25 UTC
can we postpone the fixes for older release after 9.1 Master ? 
 
patchinfos are not the problem, but the 9.0 already contains a version, where 
patched code not exists at all. I don't think I can do this within a day .. 
Comment 6 Sebastian Krahmer 2004-03-22 18:14:23 UTC
Um, I am not sure I understand you correctly. The patch applies clean
to SL 8.0, 8.1, 8.2? But not to Sl 9.0 and 9.1 correct?
Comment 7 Adrian Schröter 2004-03-22 18:18:13 UTC
I only checked 9.1 and 9.0 yet. no problem with 9.1, but 9.0 already needs 
some more work. the patched code does not exist at all there and I need to 
understand what it is doing at all. (insert $FLAME_ABOUT_SPAGETTI_CODE). 
 
8.x will be much more work, I am sure. 
Comment 8 Sebastian Krahmer 2004-03-22 21:17:55 UTC
The function to patch in client.c is still there:
call_in_directory(). And it makes sense to me. import.c however is missing
the cp == checks which the patch substitutes.
I will ask the author whether import.c needs fixing in earlier versions.
Comment 9 Sebastian Krahmer 2004-04-05 18:07:52 UTC
Created attachment 17910 [details]
The patch. "backported"

I removed all the sanity.sh and import.c changes since they are not necessary.
This one applied clean to 1.11.6, so I think it should not be a problem
to fix old boxes now. I will attach a second fix from Derek too,
which fixes some module bug. I also tried this one and it also
applies to older versions. With some line-offset :-)
Comment 10 Sebastian Krahmer 2004-04-05 18:08:23 UTC
Created attachment 17911 [details]
2nd necessary patch

...
Comment 11 Adrian Schröter 2004-04-08 00:02:05 UTC
thank you a lot. 
 
all packages have been submitted. 
closing this bug or reassign ? 
Comment 12 Sebastian Krahmer 2004-04-09 17:11:20 UTC
No, please leave open. We need it for tracking.
Comment 13 Sebastian Krahmer 2004-04-09 17:15:37 UTC
I think there are patchinfo files missing. I will create them on monday,
as I think it will be useless today.
Comment 14 Sebastian Krahmer 2004-04-12 18:13:21 UTC
Created attachment 18205 [details]
patchfile

...
Comment 15 Sebastian Krahmer 2004-04-12 18:13:51 UTC
Created attachment 18206 [details]
patchfile for box

...
Comment 16 Sebastian Krahmer 2004-04-15 00:00:01 UTC
Packages have been approved and announced.
Comment 17 Thomas Biege 2009-10-13 20:18:32 UTC
CVE-2004-0180: CVSS v2 Base Score: 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N)