fkie_cve-2004-0396
Vulnerability from fkie_nvd
Published
2004-06-14 04:00
Modified
2025-04-03 01:03
Severity ?
Summary
Heap-based buffer overflow in CVS 1.11.x up to 1.11.15, and 1.12.x up to 1.12.7, when using the pserver mechanism allows remote attackers to execute arbitrary code via Entry lines.
References
cve@mitre.orgftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2004-008.txt.asc
cve@mitre.orgftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:10.cvs.asc
cve@mitre.orghttp://archives.neohapsis.com/archives/fulldisclosure/2004-05/0980.html
cve@mitre.orghttp://cert.uni-stuttgart.de/archive/bugtraq/2004/05/msg00219.html
cve@mitre.orghttp://lists.grok.org.uk/pipermail/full-disclosure/2004-May/021742.html
cve@mitre.orghttp://marc.info/?l=bugtraq&m=108498454829020&w=2
cve@mitre.orghttp://marc.info/?l=bugtraq&m=108500040719512&w=2
cve@mitre.orghttp://marc.info/?l=bugtraq&m=108636445031613&w=2
cve@mitre.orghttp://marc.info/?l=openbsd-security-announce&m=108508894405639&w=2
cve@mitre.orghttp://secunia.com/advisories/11641
cve@mitre.orghttp://secunia.com/advisories/11647
cve@mitre.orghttp://secunia.com/advisories/11651
cve@mitre.orghttp://secunia.com/advisories/11652
cve@mitre.orghttp://secunia.com/advisories/11674
cve@mitre.orghttp://security.e-matters.de/advisories/072004.html
cve@mitre.orghttp://security.gentoo.org/glsa/glsa-200405-12.xml
cve@mitre.orghttp://www.ciac.org/ciac/bulletins/o-147.shtml
cve@mitre.orghttp://www.debian.org/security/2004/dsa-505Patch, Vendor Advisory
cve@mitre.orghttp://www.kb.cert.org/vuls/id/192038Patch, Third Party Advisory, US Government Resource
cve@mitre.orghttp://www.mandriva.com/security/advisories?name=MDKSA-2004:048
cve@mitre.orghttp://www.osvdb.org/6305
cve@mitre.orghttp://www.redhat.com/support/errata/RHSA-2004-190.htmlPatch, Vendor Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/10384
cve@mitre.orghttp://www.slackware.com/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.395865
cve@mitre.orghttp://www.us-cert.gov/cas/techalerts/TA04-147A.htmlUS Government Resource
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/16193
cve@mitre.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9058
cve@mitre.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A970
af854a3a-2127-422b-91ae-364da2661108ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2004-008.txt.asc
af854a3a-2127-422b-91ae-364da2661108ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:10.cvs.asc
af854a3a-2127-422b-91ae-364da2661108http://archives.neohapsis.com/archives/fulldisclosure/2004-05/0980.html
af854a3a-2127-422b-91ae-364da2661108http://cert.uni-stuttgart.de/archive/bugtraq/2004/05/msg00219.html
af854a3a-2127-422b-91ae-364da2661108http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/021742.html
af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=bugtraq&m=108498454829020&w=2
af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=bugtraq&m=108500040719512&w=2
af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=bugtraq&m=108636445031613&w=2
af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=openbsd-security-announce&m=108508894405639&w=2
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/11641
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/11647
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/11651
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/11652
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/11674
af854a3a-2127-422b-91ae-364da2661108http://security.e-matters.de/advisories/072004.html
af854a3a-2127-422b-91ae-364da2661108http://security.gentoo.org/glsa/glsa-200405-12.xml
af854a3a-2127-422b-91ae-364da2661108http://www.ciac.org/ciac/bulletins/o-147.shtml
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2004/dsa-505Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.kb.cert.org/vuls/id/192038Patch, Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDKSA-2004:048
af854a3a-2127-422b-91ae-364da2661108http://www.osvdb.org/6305
af854a3a-2127-422b-91ae-364da2661108http://www.redhat.com/support/errata/RHSA-2004-190.htmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/10384
af854a3a-2127-422b-91ae-364da2661108http://www.slackware.com/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.395865
af854a3a-2127-422b-91ae-364da2661108http://www.us-cert.gov/cas/techalerts/TA04-147A.htmlUS Government Resource
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/16193
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9058
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A970
Impacted products
Vendor Product Version
cvs cvs 1.11
cvs cvs 1.12


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cvs:cvs:1.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "D92B456C-5F8E-4DC2-940C-AE06B42DD3A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cvs:cvs:1.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "36BFAB00-58EA-43B7-93FB-874EF4104C5B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Heap-based buffer overflow in CVS 1.11.x up to 1.11.15, and 1.12.x up to 1.12.7, when using the pserver mechanism allows remote attackers to execute arbitrary code via Entry lines."
    },
    {
      "lang": "es",
      "value": "Desbordamiento basado en la pila en CVS 1.11.X a 1.11.5 y 1.12. a 1.12.7, cuando se usa el mecanismo pserver, permite a atacantes remotos ejecutar c\u00f3digo arbitrario mediante lineas de Entradas."
    }
  ],
  "id": "CVE-2004-0396",
  "lastModified": "2025-04-03T01:03:51.193",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2004-06-14T04:00:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2004-008.txt.asc"
    },
    {
      "source": "cve@mitre.org",
      "url": "ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:10.cvs.asc"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2004-05/0980.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://cert.uni-stuttgart.de/archive/bugtraq/2004/05/msg00219.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/021742.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://marc.info/?l=bugtraq\u0026m=108498454829020\u0026w=2"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://marc.info/?l=bugtraq\u0026m=108500040719512\u0026w=2"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://marc.info/?l=bugtraq\u0026m=108636445031613\u0026w=2"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://marc.info/?l=openbsd-security-announce\u0026m=108508894405639\u0026w=2"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/11641"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/11647"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/11651"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/11652"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/11674"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://security.e-matters.de/advisories/072004.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://security.gentoo.org/glsa/glsa-200405-12.xml"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.ciac.org/ciac/bulletins/o-147.shtml"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.debian.org/security/2004/dsa-505"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/192038"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2004:048"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.osvdb.org/6305"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.redhat.com/support/errata/RHSA-2004-190.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/10384"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2004\u0026m=slackware-security.395865"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/cas/techalerts/TA04-147A.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16193"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9058"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A970"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2004-008.txt.asc"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:10.cvs.asc"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2004-05/0980.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://cert.uni-stuttgart.de/archive/bugtraq/2004/05/msg00219.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/021742.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://marc.info/?l=bugtraq\u0026m=108498454829020\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://marc.info/?l=bugtraq\u0026m=108500040719512\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://marc.info/?l=bugtraq\u0026m=108636445031613\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://marc.info/?l=openbsd-security-announce\u0026m=108508894405639\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/11641"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/11647"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/11651"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/11652"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/11674"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://security.e-matters.de/advisories/072004.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://security.gentoo.org/glsa/glsa-200405-12.xml"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ciac.org/ciac/bulletins/o-147.shtml"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.debian.org/security/2004/dsa-505"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/192038"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2004:048"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.osvdb.org/6305"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.redhat.com/support/errata/RHSA-2004-190.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/10384"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2004\u0026m=slackware-security.395865"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/cas/techalerts/TA04-147A.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16193"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9058"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A970"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.