CVE-2003-0977: High severity CVS CVS vulnerability
Published Dec 10, 2003
·Updated
CVS server before 1.11.10 may allow attackers to cause the CVS server to create directories and files in the file system root directory via malformed module requests.
Affected Software
13 affected components
CVS CVS=1.11.1
CVS CVS=1.11
CVS CVS=1.11.4
CVS CVS=1.11.5
CVS CVS=1.10.8
CVS CVS=1.11.6
CVS CVS=1.11.3
CVS CVS=1.11.2
CVS CVS=1.10.7
CVS CVS=1.11.1_p1
Slackware Slackware Linux=9.0
Slackware Slackware Linux=8.1
Slackware Slackware Linux=9.1
Remediation
Patch Available
Event History
Dec 10, 2003
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Jan 5, 2004
Data Sourced
via NVD·05:00 AM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2003-0977?
CVE-2003-0977 is classified as a moderate severity vulnerability.
2
How do I fix CVE-2003-0977?
To mitigate CVE-2003-0977, upgrade the CVS server to a version later than 1.11.10.
3
What versions of CVS are affected by CVE-2003-0977?
CVE-2003-0977 affects CVS server versions 1.10.7, 1.10.8, and all 1.11.x versions up to 1.11.10.
4
What type of attack does CVE-2003-0977 enable?
CVE-2003-0977 allows attackers to create arbitrary directories and files in the root file system through malformed module requests.
5
Is there a known exploit for CVE-2003-0977?
Yes, there are known exploits that take advantage of the CVE-2003-0977 vulnerability to compromise the CVS server.