APP: CVS Entry Line Tag Heap Overflow

This signature detects attempts to exploit a known vulnerability against Concurrent Versions System (CVS). Because CVS does not handle flag attachments correctly, attackers can send a malicious request to the CVS server to overwrite CVS memory, create a denial-of-service (DoS), or execute arbitrary code. To exploit this vulnerability, the attacker must use valid login ID and password for the CVS server, but an anonymous, read-only account is sufficient.

Extended Description

CVS is prone to a remote heap overflow vulnerability. This issue presents itself during the handling of user-supplied input for entry lines with 'modified' and 'unchanged' flags. This vulnerability can allow an attacker to overflow a vulnerable buffer on the heap, possibly leading to arbitrary code execution. CVS versions 1.11.15 and prior and CVS feature versions 1.12.7 and prior are prone to this issue. **UPDATE: Symantec has confirmed that this vulnerability is being actively exploited in the wild. Administrators are urged to upgrade and block external access to potentially vulnerable servers, if possible.

Affected Products

Cvs cvs

References

BugTraq: 10384

CVE: CVE-2004-0396

URL: http://www.securiteam.com/unixfocus/5HP0E2KCUU.html http://www.us-cert.gov/cas/techalerts/TA04-147A.html

Short Name

APP:CVS:ENTRY-TAG-OF

Severity

Major

Recommended

False

Recommended Action

Drop

APP: CVS Entry Line Tag Heap Overflow

Extended Description

Affected Products

References

Found a potential security threat?