ViewVC before 1.1.3 composes the root listing view without using the authorizer for each root, which might allow remote attackers to discover private root names by reading this view.

The viewvc update fixes the following security problems :

  - add root listing support of per-root authz config     (CVE-2010-0004).

  - query.py requires 'forbidden' authorizer (or none) in     config (CVE-2010-0005).

- security fix: add root listing support of per-root authz     config * security fix: query.py requires 'forbidden'     authorizer (or none) in config * fix URL- ification of     truncated log messages (issue #3) * fix regexp input     validation (issue #426, #427, #440) * add support for     configurable tab-to-spaces conversion * fix     not-a-sequence error in diff view * allow viewvc-install     to work when templates-contrib is absent * minor     template improvements/corrections

  - expose revision metadata in diff view (issue #431) *     markup file/directory item property URLs and email     addresses (issue #434) * make ViewVC cross copies in     Subversion history by default * fix bug that caused     standalone.py failure under Python 1.5.2 (issue #442) *     fix support for per-vhost overrides of authorizer     parameters (issue #411) * fix root name identification     in query.py interface

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
44322	openSUSE Security Update : viewvc (viewvc-1859)	Nessus	SuSE Local Security Checks	high
43607	Fedora 11 : viewvc-1.1.3-1.fc11 (2009-13634)	Nessus	Fedora Local Security Checks	high
43606	Fedora 12 : viewvc-1.1.3-1.fc12 (2009-13610)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2010-0004

critical

Tenable Plugins

high

high

high