CVE-2004-0417: Integer Overflow
Published Jun 11, 2004
·Updated
Integer overflow in the "Max-dotdot" CVS protocol command (servemaxdotdot) for CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to cause a server crash, which could cause temporary data to remain undeleted and consume disk space.
Affected Software
29 affected components
CVS CVS=1.10.7
CVS CVS=1.10.8
CVS CVS=1.11
CVS CVS=1.11.1
CVS CVS=1.11.1_p1
CVS CVS=1.11.2
CVS CVS=1.11.3
CVS CVS=1.11.4
CVS CVS=1.11.5
CVS CVS=1.11.6
CVS CVS=1.11.10
CVS CVS=1.11.11
CVS CVS=1.11.14
CVS CVS=1.11.15
CVS CVS=1.11.16
CVS CVS=1.12.1
CVS CVS=1.12.2
CVS CVS=1.12.5
CVS CVS=1.12.7
CVS CVS=1.12.8
Openpkg Openpkg
Openpkg Openpkg=1.3
Openpkg Openpkg=2.0
Sgi Propack=2.4
Sgi Propack=3.0
Gentoo Linux=1.4
OpenBSD OpenBSD
OpenBSD OpenBSD=3.4
OpenBSD OpenBSD=3.5
Remediation
Patch Available
Event History
Jun 11, 2004
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-0417?
CVE-2004-0417 is a high severity vulnerability that can lead to server crashes.
2
How do I fix CVE-2004-0417?
To mitigate CVE-2004-0417, upgrade CVS to version 1.12.9 or later.
3
Which software versions are affected by CVE-2004-0417?
CVE-2004-0417 affects CVS versions 1.12.8 and earlier, and 1.11.16 and earlier.
4
What impact does CVE-2004-0417 have on systems?
CVE-2004-0417 can cause temporary data to remain undeleted, consuming disk space.
5
Can CVE-2004-0417 be exploited remotely?
Yes, CVE-2004-0417 can be exploited by remote attackers via the CVS protocol.