===================================================================== CERT-Renater Note d'Information No. 2004/VULN579 _____________________________________________________________________ DATE : 30/12/2004 HARDWARE PLATFORM(S) : / OPERATING SYSTEM(S) : Systems running ViewCVS. ====================================================================== - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200412-26 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Low Title: ViewCVS: Information leak and XSS vulnerabilities Date: December 28, 2004 Bugs: #72461, #73772 ID: 200412-26 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== ViewCVS is vulnerable to an information leak and to cross-site scripting (XSS) issues. Background ========== ViewCVS is a browser interface for viewing CVS and Subversion version control repositories through a web browser. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-apps/viewcvs <= 0.9.2_p20041207 >= 0.9.2_p20041207-r1 Description =========== The tar export functions in ViewCVS bypass the 'hide_cvsroot' and 'forbidden' settings and therefore expose information that should be kept secret (CAN-2004-0915). Furthermore, some error messages in ViewCVS do not filter user-provided information, making it vulnerable to a cross-site scripting attack (CAN-2004-1062). Impact ====== By using the tar export functions, a remote attacker could access information that is configured as restricted. Through the use of a malicious request, an attacker could also inject and execute malicious script code, potentially compromising another user's browser. Workaround ========== There is no known workaround at this time. Resolution ========== All ViewCVS users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=www-apps/viewcvs-0.9.2_p20041207-r1" References ========== [ 1 ] CAN-2004-0915 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0915 [ 2 ] CAN-2004-1062 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1062 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200412-26.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org. License ======= Copyright 2004 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.0 ====================================================================== ========================================================= Les serveurs de référence du CERT-Renater http://www.urec.fr/securite http://www.cru.fr/securite http://www.renater.fr ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 151 bd de l'Hopital | fax : 01-53-94-20-41 + + 75013 Paris | email: certsvp@renater.fr + =========================================================