[SECURITY-L] CAIS-Alerta: Vulnerabilidade no CVS

Qui Maio 27 16:46:34 -03 2004

----- Forwarded message from Centro de Atendimento a Incidentes de Seguranca <cais em cais.rnp.br> -----

From: Centro de Atendimento a Incidentes de Seguranca <cais em cais.rnp.br>
Subject:  CAIS-Alerta: Vulnerabilidade no CVS
To: rnp-alerta em cais.rnp.br, rnp-seg em cais.rnp.br
Date: Thu, 27 May 2004 13:22:00 -0300 (BRST)

-----BEGIN PGP SIGNED MESSAGE-----

Prezados,

O CAIS esta' repassando o alerta do US-CERT, intitulado "TA04-147A - CVS 
Heap Overflow Vulnerability", que trata de uma vulnerabilidade que afeta o 
CVS (Concurrent Versions System), um sistema de gerenciamento de 
codigo-fonte amplamente utilizado em projetos Open Source.

Esta vulnerabilidade permite que um atacante remoto execute codigo 
arbitrario, comandos, modifique informacoes sensiveis ou mesmo cause uma 
condicao de Negacao de Servico (DoS) no sistema vulneravel.

Sistemas afetados:

. Stable CVS anteriores a versao 1.11.16
. CVS Feature anteriores a versao 1.12.8

Correcoes disponiveis:

Recomenda-se o upgrade ou aplicacao de correcao (patch) oferecida pelo seu 
fornecedor. Para obter uma lista de correcoes por fornecedor consulte:

. US-CERT Vulnerability Note VU#192038
  http://www.kb.cert.org/vuls/id/192038

Outras opcoes para se solucionar o problema sao (1) desabilitar o servidor 
CVS ou (2) bloquear/restringir acesso seguindo as orientacoes do alerta 
original do US-CERT.

Mais informacoes:

. TA04-147A - CVS Heap Overflow Vulnerability (US-CERT)
  http://www.us-cert.gov/cas/techalerts/TA04-147A.html

. Advisory 07/2004 - CVS remote vulnerability (e-matters Security)
  http://security.e-matters.de/advisories/072004.html

. Chrooted SSH CVS server HOW-TO (IDEALX)
  http://www.netsys.com/library/papers/chrooted-ssh-cvs-server.txt

Identificador CVE: CAN-2004-0396 (http://cve.mitre.org)

O CAIS recomenda aos administradores manterem seus sistemas e aplicativos
sempre atualizados, de acordo com as ultimas versoes e correcoes
disponibilizadas pelos fabricantes.

Atenciosamente,

################################################################
#   CENTRO DE ATENDIMENTO A INCIDENTES DE SEGURANCA (CAIS)     #
#       Rede Nacional de Ensino e Pesquisa (RNP)               #
#                                                              #
# cais em cais.rnp.br       http://www.cais.rnp.br                #
# Tel. 019-37873300      Fax. 019-37873301                     #
# Chave PGP disponivel   http://www.rnp.br/cais/cais-pgp.key   #
################################################################

CVS Heap Overflow Vulnerability
Original release date: May 26, 2004
Last revised: --
Source: US-CERT

Systems Affected

     * Concurrent Versions System (CVS) versions prior to 1.11.16
     * CVS Features versions prior to 1.12.8

Overview

A heap overflow vulnerability in the Concurrent Versions System (CVS) 
could allow a remote attacker to execute arbitrary code on a vulnerable 
system.
I. Description

CVS is a source code maintenance system that is widely used by open-source 
software development projects. There is a heap memory overflow 
vulnerability in the way CVS handles the insertion of modified and 
unchanged flags within entry lines. When processing an entry line, an 
additional byte of memory is allocated to flag the entry as modified or 
unchanged. There is a failure to check if a byte has been previously 
allocated for the flag, which creates an off-by-one buffer overflow. By 
calling a vulnerable function several times and inserting specific 
characters into the entry lines, a remote attacker could overwrite 
multiple blocks of memory. In some environments, the CVS server process is 
started by the Internet services daemon (inetd) and may run with root 
privileges.

An authenticated client could exploit this vulnerability to execute 
arbitrary code, execute commands, modify sensitive information, or cause a 
denial of service. Note that if a CVS server is configured to permit 
anonymous read-only access, then this provides sufficient access to 
exploit a vulnerable server, as anonymous users are authenticated through 
the cvspserver process.

US-CERT is tracking this issue as VU#192038. This reference number 
corresponds to CVE candidate CAN-2004-0396.
II. Impact

An authenticated client could exploit this vulnerability to execute 
arbitrary code on the vulnerable system with the privileges of the CVS 
server process. It is possible for an anonymous user with read-only access 
to exploit a vulnerable server as they are authenticated through the 
cvspserver process.

In addition to compromising the system running CVS, there is a significant 
secondary impact in that source code maintained in CVS repositories could 
be modified to include Trojan horses, backdoors, or other malicious code.

III. Solution
Apply Patch or Upgrade

     Apply the appropriate patch or upgrade as specified by your vendor. 
For vendor specific responses, please see your vendor's website or 
Vulnerability Note VU#192038.

     This issue has been resolved in Stable CVS Version 1.11.16 and CVS 
Feature Version 1.12.8.

Disable CVS Server

     Until a patch or upgrade can be applied, consider disabling the CVS 
server.

Block or Restrict Access

     Block or restrict access to the CVS server from untrusted hosts and 
networks. The CVS server typically listens on 2401/tcp, but may use 
another port or protocol.

     Limit CVS Server Privileges

         * Configure CVS server to run in a restricted (chroot) 
environment.
         * Run CVS servers with the minimum set of privileges required on 
the host file system.
         * Provide separate systems for development (write) and 
public/anonymous (read-only) CVS access.
         * Host public/anonymous CVS servers on single-purpose, secured 
systems.

     Note that some of these workarounds will only limit the scope and 
impact of possible attacks. Note also that anonymous (read-only) access is 
sufficent to exploit this vulnerability.

Appendix B. References

     * http://security.e-matters.de/advisories/072004.html
     * http://secunia.com/advisories/11641/
     * http://www.securitytracker.com/alerts/2004/May/1010208.html
     * http://www.netsys.com/library/papers/chrooted-ssh-cvs-server.txt

US-CERT thanks Stefan Esser of e-matters for reporting this problem and 
for information used to construct this advisory.

Feedback can be directed to the authors: Jason A. Rafail and Damon Morda

Revision History

May 26, 2004: Initial release

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.8

iQCVAwUBQLYVsekli63F4U8VAQHZ4QP/cyBHuUeDhWoeHfmbjhEXlFJwbQvuUwY2
N0HAB8F5v4LC3mAkST89zcFv63moGiuKcp3KHlyodDUIoGznQGjmMNaMa9sf8+TZ
muizKvUNtqzD2jqh5l3iGiga285Mkb2Tuo0ytDH9kCp0CIFagDizNgZQUi9C3Eky
5r1wSAV0LSo=
=e/VS
-----END PGP SIGNATURE-----

----- End forwarded message -----