Debian CVS Password Protection Bypass and Denial of Service - Secunia Advisories - Vulnerability Intelligence

Home > Vulnerability Intelligence > Secunia Advisories > Debian CVS Password Protection Bypass and Denial of Service

Secunia Advisories

Advisories

Advisories by Product

Business Solutions Restricted

Partner Solutions Restricted

About

Debian CVS Password Protection Bypass and Denial of Service
Secunia Advisory:	SA15126	Advisory Toolbox: Issue ticket Save in to-do list Mark as handled Exploit information Download as PDF Review actions Add comment
Release Date:	2005-04-27
Last Update:	2005-05-06
Popularity:	6,566 views

Critical:	Moderately critical
Impact:	Security Bypass DoS
Where:	From remote
Solution Status:	Vendor Patch

OS:	Debian GNU/Linux 3.0 Debian GNU/Linux unstable alias sid

Subscribe:	Instant alerts on relevant vulnerabilities

CVE reference:	CVE-2004-1342 CVE-2004-1343

Description: Debian has issued an update for cvs. This fixes two vulnerabilities, which can be exploited by malicious people to bypass password protection or cause a DoS (Denial of Service). 1) A security issue makes it possible to bypass the password protection and gain access to a repository when using the pserver access method. 2) A vulnerability can be exploited to crash the CVS server when the cvs-repouids file exists but doesn't contain a mapping for the current repository. Solution: Apply updated packages. -- Debian GNU/Linux 3.0 alias woody -- Source archives: http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-10.dsc Size/MD5 checksum: 683 59823fd39bbbe16620d03a946936885c http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-10.diff.gz Size/MD5 checksum: 55952 02e1d3ce442838837defa5952f548582 http://security.debian.org/pool/updat.../c/cvs/cvs_1.11.1p1debian.orig.tar.gz Size/MD5 checksum: 2621658 500965ab9702b31605f8c58aa21a6205 Alpha architecture: http://security.debian.org/pool/updat...c/cvs/cvs_1.11.1p1debian-10_alpha.deb Size/MD5 checksum: 1179144 9282b85f488096912601c02110ff40ad ARM architecture: http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-10_arm.deb Size/MD5 checksum: 1106418 270ed04648a240ffe138c53dcc21e23f Intel IA-32 architecture: http://security.debian.org/pool/updat.../c/cvs/cvs_1.11.1p1debian-10_i386.deb Size/MD5 checksum: 1085370 a6a9d6e768bf94ff2d73f7c4297b4bfe Intel IA-64 architecture: http://security.debian.org/pool/updat.../c/cvs/cvs_1.11.1p1debian-10_ia64.deb Size/MD5 checksum: 1272522 843265de87691b70f7f3791b1de14787 HP Precision architecture: http://security.debian.org/pool/updat.../c/cvs/cvs_1.11.1p1debian-10_hppa.deb Size/MD5 checksum: 1148284 7e28816777f07485cffcf2065e948c1d Motorola 680x0 architecture: http://security.debian.org/pool/updat.../c/cvs/cvs_1.11.1p1debian-10_m68k.deb Size/MD5 checksum: 1066564 62613fcbc6eddef7b4eb6103ef5849ae Big endian MIPS architecture: http://security.debian.org/pool/updat.../c/cvs/cvs_1.11.1p1debian-10_mips.deb Size/MD5 checksum: 1130690 a0b311ef90ea76653c119c729e6d9c79 Little endian MIPS architecture: http://security.debian.org/pool/updat.../cvs/cvs_1.11.1p1debian-10_mipsel.deb Size/MD5 checksum: 1132148 e818238493b1b589410f802fc4166702 PowerPC architecture: http://security.debian.org/pool/updat...cvs/cvs_1.11.1p1debian-10_powerpc.deb Size/MD5 checksum: 1117054 887d8a61fc0f66bba26125aca927b6f4 IBM S/390 architecture: http://security.debian.org/pool/updat.../c/cvs/cvs_1.11.1p1debian-10_s390.deb Size/MD5 checksum: 1097842 43799198fefec02e443e065d839b5530 Sun Sparc architecture: http://security.debian.org/pool/updat...c/cvs/cvs_1.11.1p1debian-10_sparc.deb Size/MD5 checksum: 1107744 a6cf45a0ea45609b1e1e9e381ec0b62e -- Debian GNU/Linux unstable alias sid -- Fixed in version 1.12.9-11. Provided and/or discovered by: 1) Maks Polunin and Alberto Garcia 2) Alberto Garcia Changelog: 2005-05-06: Added link to US-CERT vulnerability note. Original Advisory: http://www.debian.org/security/2005/dsa-715 Other References: US-CERT VU#327037: http://www.kb.cert.org/vuls/id/327037

Track this Secunia Advisory
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released. Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.

About this Secunia Advisory
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise. Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.

Latest Advisories

5th Sep, 2008

New advisories:	14
New vulnerabilities:	18
Updated advisories:	22

Less // 352 views

Netgear WN802T Wireless Access Point Two Vulnerabilities

Less // 281 views

Fedora update for xastir

Less // 357 views

XASTIR Insecure Temporary Files

Less // 293 views

Fedora update for samba

Less // 293 views

Fedora update for bitlbee

Less // 732 views

3Com Wireless 8760 Access Point HTTP Request Processing Denial of Service

Moderately // 596 views

CS-Cart "cs_cookies" SQL Injection Vulnerability

Less // 675 views

Drupal Content Construction Kit Script Insertion Vulnerabilities

Less // 666 views

HP OpenView Select Identity Connectors Information Disclosure

Moderately // 544 views

rPath update for libtiff

Solutions | More...

Send Feedback to Secunia
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com. Ideas, suggestions, and other feedback are most welcome.