CVS < 1.11.17 / 1.12.9 Multiple Vulnerabilities

High Nessus Plugin ID 12265


The remote CVS server is affected by multiple issues.


The remote CVS server, according to its version number, might allow an attacker to execute arbitrary commands on the remote system because of a flaw relating to malformed Entry lines which lead to a missing NULL terminator.

Among the issues deemed likely to be exploitable were:

- A double-free relating to the error_prog_name string. (CVE-2004-0416)

- An argument integer overflow. (CVE-2004-0417)

- Out-of-bounds writes in serv_notify. (CVE-2004-0418)


Upgrade to CVS 1.12.9 or 1.11.17.

See Also

Plugin Details

Severity: High

ID: 12265

File Name: cvs_malformed_entry_lines_flaw.nasl

Version: $Revision: 1.24 $

Type: remote

Family: Misc.

Published: 2004/06/09

Modified: 2017/05/11

Dependencies: 12240, 17975

Risk Information

Risk Factor: High


Base Score: 7.1

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:H/Au:S/C:C/I:C/A:C

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 2004/06/09

Reference Information

CVE: CVE-2004-0414, CVE-2004-0416, CVE-2004-0417, CVE-2004-0418, CVE-2004-1471

BID: 10499

OSVDB: 6830, 6831, 6832, 6833, 6834, 6835, 6836, 15727

RHSA: 2004:233-017

CWE: 119