CVS server before 1.11.10 may allow attackers to cause the CVS server to create directories and files in the file system root directory via malformed module requests.

The remote CVS server, according to its version number, may allow an attacker to create directories and possibly files at the root of the filesystem holding the CVS repository.

A vulnerability was discovered in the CVS server < 1.11.10 where a malformed module request could cause the CVS server to attempt to create directories and possibly files at the root of the filesystem holding the CVS repository.

Updated packages are available that fix the vulnerability by providing CVS 1.11.10 on all supported distributions.

Update :

The previous updates had an incorrect temporary directory hard-coded in the cvs binary for 9.1 and 9.2. This update corrects the problem.

Updated cvs packages closing a vulnerability that could allow cvs to attempt to create files and directories in the root file system are now available.

CVS is a version control system frequently used to manage source code repositories.

A flaw was found in versions of CVS prior to 1.11.10 where a malformed module request could cause the CVS server to attempt to create files or directories at the root level of the file system. However, normal file system permissions would prevent the creation of these misplaced directories. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0977 to this issue.

Users of CVS are advised to upgrade to these erratum packages, which contain a patch correcting this issue.

For Red Hat Enterprise Linux 2.1, these updates also fix an off-by-one overflow in the CVS PreservePermissions code. The PreservePermissions feature is not used by default (and can only be used for local CVS).
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2002-0844 to this issue.

According to its version number, the CVS server running on the remote remote host may allow an attacker to create directories (and possibly files) at the root of the filesystem where the CVS repository is located.

ID	Name	Product	Family	Severity
1180	CVS < 1.11.10 / 1.12.3 pserver Crafted Module Request Arbitrary File / Directory Creation	Nessus Network Monitor	Generic	medium
14094	Mandrake Linux Security Advisory : cvs (MDKSA-2003:112-1)	Nessus	Mandriva Local Security Checks	high
12446	RHEL 2.1 / 3 : cvs (RHSA-2004:004)	Nessus	Red Hat Local Security Checks	high
11947	CVS pserver Crafted Module Request Arbitrary File / Directory Creation	Nessus	Misc.	medium

Detections

Analytics

CVE-2003-0977

critical

Tenable Plugins

medium

high

high

medium