CVE-2004-0414

Current Description

CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle malformed "Entry" lines, which prevents a NULL terminator from being used and may lead to a denial of service (crash), modification of critical program data, or arbitrary code execution.

Basic Data

PublishedAugust 06, 2004
Last ModifiedMay 03, 2018
Assignercve@mitre.org
Data TypeCVE
Data FormatMITRE
Data Version4.0
Problem TypeNVD-CWE-Other
CVE Data Version4.0

Base Metric V2

CVSS 2 - Version2.0
CVSS 2 - Vector StringAV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS 2 - Access VectorNETWORK
CVSS 2 - Access ComplexityLOW
CVSS 2 - AuthenticationNONE
CVSS 2 - Confidentiality ImpactCOMPLETE
CVSS 2 - Availability ImpactCOMPLETE
CVSS 2 - Base Score10.0
SeverityHIGH
Exploitability Score10.0
Impact Score10.0
Obtain All Privilegetrue
Obtain User Privilegefalse
Obtain Other Privilegefalse

Base Metric V3

No data provided.

Configurations

  • OR - Configuration 1
    Cpe VersionPartVendorProductVersionUpdateEditionLanguageSW EditionTarget SWTarget HWOtherVersion Start IncludingVersion End IncludingVersion Start ExcludingVersion End Excluding
    2.3ApplicationCvsCvs1.10.7*******
    2.3ApplicationCvsCvs1.10.8*******
    2.3ApplicationCvsCvs1.11*******
    2.3ApplicationCvsCvs1.11.1*******
    2.3ApplicationCvsCvs1.11.1_p1*******
    2.3ApplicationCvsCvs1.11.2*******
    2.3ApplicationCvsCvs1.11.3*******
    2.3ApplicationCvsCvs1.11.4*******
    2.3ApplicationCvsCvs1.11.5*******
    2.3ApplicationCvsCvs1.11.6*******
    2.3ApplicationCvsCvs1.11.10*******
    2.3ApplicationCvsCvs1.11.11*******
    2.3ApplicationCvsCvs1.11.14*******
    2.3ApplicationCvsCvs1.11.15*******
    2.3ApplicationCvsCvs1.11.16*******
    2.3ApplicationCvsCvs1.12.1*******
    2.3ApplicationCvsCvs1.12.2*******
    2.3ApplicationCvsCvs1.12.5*******
    2.3ApplicationCvsCvs1.12.7*******
    2.3ApplicationCvsCvs1.12.8*******
    2.3ApplicationOpenpkgOpenpkg********
    2.3ApplicationOpenpkgOpenpkg1.3*******
    2.3ApplicationOpenpkgOpenpkg2.0*******
    2.3ApplicationSgiPropack2.4*******
    2.3ApplicationSgiPropack3.0*******
  • OR - Configuration 2
    Cpe VersionPartVendorProductVersionUpdateEditionLanguageSW EditionTarget SWTarget HWOtherVersion Start IncludingVersion End IncludingVersion Start ExcludingVersion End Excluding
    2.3OSGentooLinux1.4*******
    2.3OSOpenbsdOpenbsd********
    2.3OSOpenbsdOpenbsd3.4*******
    2.3OSOpenbsdOpenbsd3.5*******

Vulnerable Software List

VendorProductVersions
Cvs Cvs 1.10.7, 1.10.8, 1.11, 1.11.1, 1.11.10, 1.11.11, 1.11.14, 1.11.15, 1.11.16, 1.11.1_p1, 1.11.2, 1.11.3, 1.11.4, 1.11.5, 1.11.6, 1.12.1, 1.12.2, 1.12.5, 1.12.7, 1.12.8
Openbsd Openbsd *, 3.4, 3.5
Openpkg Openpkg *, 1.3, 2.0
Sgi Propack 2.4, 3.0
Gentoo Linux 1.4

References

NameSourceURLTags
20040604-01-Uftp://patches.sgi.com/support/free/security/advisories/20040604-01-U.ascSGI
20040605-01-Uftp://patches.sgi.com/support/free/security/advisories/20040605-01-U.ascSGI
20040609 Advisory 09/2004: More CVS remote vulnerabilitieshttp://lists.grok.org.uk/pipermail/full-disclosure/2004-June/022441.htmlFULLDISC
20040611 [OpenPKG-SA-2004.027] OpenPKG Security Advisory (cvs)http://marc.info/?l=bugtraq&m=108716553923643&w=2BUGTRAQ
http://security.e-matters.de/advisories/092004.htmlhttp://security.e-matters.de/advisories/092004.htmlMISC
GLSA-200406-06http://security.gentoo.org/glsa/glsa-200406-06.xmlGENTOOVendor Advisory
DSA-517http://www.debian.org/security/2004/dsa-517DEBIANPATCH Vendor Advisory
MDKSA-2004:058http://www.mandriva.com/security/advisories?name=MDKSA-2004:058MANDRAKE
RHSA-2004:233http://www.redhat.com/support/errata/RHSA-2004-233.htmlREDHAT
oval:org.mitre.oval:def:10575https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10575OVAL
oval:org.mitre.oval:def:993https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A993OVAL