ViewVC before 1.1.11 allows remote attackers to bypass the cvsdb row_limit configuration setting, and consequently conduct resource-consumption attacks, via the limit parameter, as demonstrated by a "query revision history" request.

cvsdb.py in viewvc did not honor an admin defined row limit which could cause high load on the database server. viewvc was updated to version 1.1.11 which fixes the issue (CVE-2009-5024).

Several vulnerabilities were found in ViewVC, a web interface for CVS and Subversion repositories.

  - CVE-2009-5024     Remote attackers can bypass the cvsdb row_limit     configuration setting, and consequently conduct     resource-consumption attacks via the limit parameter.

  - CVE-2012-3356     The remote Subversion views functionality does not     properly perform authorization, which allows remote     attackers to bypass intended access restrictions.

  - CVE-2012-3357     The Subversion revision view does not properly handle     log messages when a readable path is copied from an     unreadable path, which allows remote attackers to obtain     sensitive information.

  - CVE-2012-4533     'function name' lines returned by diff are not properly     escaped, allowing attackers with commit access to     perform cross site scripting.

- security fix: remove user-reachable override of cvsdb     row limit

    - fix broken standalone.py -c and -d options handling

    - add --help option to standalone.py

    - fix stack trace when asked to checkout a directory       (issue #478)

    - improve memory usage and speed of revision log markup       (issue #477)

    - fix broken annotation view in CVS keyword-bearing       files (issue #479)

    - warn users when query results are incomplete (issue       #443)

    - avoid parsing errors on RCS newphrases in the admin       section (issue #483)

    - make rlog parsing code more robust in certain error       cases (issue #444)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
76040	openSUSE Security Update : viewvc (openSUSE-SU-2011:0529-1)	Nessus	SuSE Local Security Checks	medium
75767	openSUSE Security Update : viewvc (openSUSE-SU-2011:0529-1)	Nessus	SuSE Local Security Checks	medium
62665	Debian DSA-2563-1 : viewvc - several vulnerabilities	Nessus	Debian Local Security Checks	medium
54909	Fedora 14 : viewvc-1.1.11-1.fc14 (2011-7222)	Nessus	Fedora Local Security Checks	medium
54908	Fedora 13 : viewvc-1.1.11-1.fc13 (2011-7198)	Nessus	Fedora Local Security Checks	medium
54907	Fedora 15 : viewvc-1.1.11-1.fc15 (2011-7185)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2009-5024

high

Tenable Plugins

medium

medium

medium

medium

medium

medium