CVE-2000-0338: Medium severity cvs cvs vulnerability
Concurrent Versions Software (CVS) uses predictable temporary file names for locking, which allows local users to cause a denial of service by creating the lock directory before it is created for use by a legitimate CVS user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the CVS locking implementation so temporary filenames used for locks are unpredictable and/or created atomically (preventing a local user from pre-creating the lock directory).
Distrotech Cvs (Concurrent Versions System) temporary lock filename generation = unpredictable / atomic creation - Compensating control
Restrict local users' ability to create the lock directory by tightening file system permissions and ACLs on the CVS repository and temporary directories (ensure only the CVS service account or trusted administrators have write/create rights).
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0338?
CVE-2000-0338 is classified as a vulnerability that can lead to a denial of service due to predictable temporary file names.
How do I fix CVE-2000-0338?
To fix CVE-2000-0338, users should upgrade to a newer version of CVS that mitigates the use of predictable temporary file names.
Who is impacted by CVE-2000-0338?
Local users on systems running affected versions of Concurrent Versions Software, such as CVS 1.10.7, are vulnerable to CVE-2000-0338.
What does CVE-2000-0338 allow attackers to do?
CVE-2000-0338 allows local users to disrupt legitimate CVS operations by creating a lock directory before a legitimate user can.
What versions of CVS are affected by CVE-2000-0338?
CVE-2000-0338 specifically affects CVS version 1.10.7.