Title: ViewCVS Source View Input Validation Vulnerability
Severity: MODERATE
Description:
ViewCVS is an application that allows users to browse CVS repositories via the web.
ViewCVS is prone to an input-validation vulnerability.
This issue resides in the script responsible for allowing users to view source files (viewcvs.py). The software fails to properly sanitize various parameters that are passed to this script; specifically, it fails to sanitize the parameters of hostile input including HTML, script code, and HTTP protocol delimiter characters. This exposes the script to cross-site scripting and HTTP-response-splitting attacks.
An attacker could exploit the issue by enticing a victim user into following a malicious link that contains hostile URI parameters. Exploitation could allow the attacker to steal cookie-based authentications and to launch other attacks, such as manipulating how site content is presented to a victim user.
This issue appears similar to BID 9291.
Affected Products:
- Debian Linux 3.0.0
- Debian Linux 3.0.0 alpha
- Debian Linux 3.0.0 arm
- Debian Linux 3.0.0 hppa
- Debian Linux 3.0.0 ia-32
- Debian Linux 3.0.0 ia-64
- Debian Linux 3.0.0 m68k
- Debian Linux 3.0.0 mips
- Debian Linux 3.0.0 mipsel
- Debian Linux 3.0.0 ppc
- Debian Linux 3.0.0 s/390
- Debian Linux 3.0.0 sparc
- S.u.S.E. Linux Personal 9.0.0
- S.u.S.E. Linux Personal 9.0.0 x86_64
- S.u.S.E. Linux Personal 9.1.0
- S.u.S.E. Linux Personal 9.2.0
- ViewCVS ViewCVS 0.9.2
- ViewVC ViewVC 1.0.2
- ViewVC ViewVC 1.0.3
References:
- ViewCVS: ViewCVS Project Page
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
