Explain CVE-2004-0396
Heap-based buffer overflow in CVS 1.11.x up to 1.11.15, and 1.12.x up to 1.12.7, when using the pserver mechanism allows remote attackers to execute arbitrary code via Entry lines.
Affected Products: n/a
References: [{'name': '11641', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/11641'}, {'name': '11652', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/11652'}, {'name': 'oval:org.mitre.oval:def:970', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A970'}, {'name': '20040519 [OpenPKG-SA-2004.022] OpenPKG Security Advisory (cvs)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=108500040719512&w=2'}, {'name': 'oval:org.mitre.oval:def:9058', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9058'}, {'name': 'MDKSA-2004:048', 'tags': ['vendor-advisory', 'x_refsource_MANDRAKE'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2004:048'}, {'name': '20040519 Advisory 07/2004: CVS remote vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://cert.uni-stuttgart.de/archive/bugtraq/2004/05/msg00219.html'}, {'name': '20040520 cvs server buffer overflow vulnerability', 'tags': ['vendor-advisory', 'x_refsource_OPENBSD'], 'url': 'http://marc.info/?l=openbsd-security-announce&m=108508894405639&w=2'}, {'name': 'FreeBSD-SA-04:10', 'tags': ['vendor-advisory', 'x_refsource_FREEBSD'], 'url': 'ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:10.cvs.asc'}, {'name': 'RHSA-2004:190', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2004-190.html'}, {'name': '11674', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/11674'}, {'name': 'GLSA-200405-12', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200405-12.xml'}, {'name': '11651', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/11651'}, {'name': '6305', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/6305'}, {'name': 'TA04-147A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA04-147A.html'}, {'name': 'O-147', 'tags': ['third-party-advisory', 'government-resource', 'x_refsource_CIAC'], 'url': 'http://www.ciac.org/ciac/bulletins/o-147.shtml'}, {'name': '20040519 Advisory 07/2004: CVS remote vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=108498454829020&w=2'}, {'name': '11647', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/11647'}, {'name': 'FEDORA-2004-1620', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://marc.info/?l=bugtraq&m=108636445031613&w=2'}, {'name': 'VU#192038', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/192038'}, {'name': '20040519 Advisory 07/2004: CVS remote vulnerability', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2004-05/0980.html'}, {'name': 'DSA-505', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2004/dsa-505'}, {'name': 'cvs-entry-line-bo(16193)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/16193'}, {'tags': ['x_refsource_MISC'], 'url': 'http://security.e-matters.de/advisories/072004.html'}, {'name': 'SSA:2004-140-01', 'tags': ['vendor-advisory', 'x_refsource_SLACKWARE'], 'url': 'http://www.slackware.com/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.395865'}, {'name': 'NetBSD-SA2004-008', 'tags': ['vendor-advisory', 'x_refsource_NETBSD'], 'url': 'ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2004-008.txt.asc'}, {'name': '10384', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/10384'}, {'name': 'SuSE-SA:2004:013', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/021742.html'}]
CVE State: PUBLISHED