CVE-2008-1292: Infoleak
First published: Mon Mar 24 2008(Updated: )
ViewVC before 1.0.5 provides revision metadata without properly checking whether access was intended, which allows remote attackers to obtain sensitive information by reading (1) forbidden pathnames in the revision view, (2) log history that can only be reached by traversing a forbidden object, or (3) forbidden diff view path parameters.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Gentoo Linux | ||
| Red Hat Fedora | =7 | |
| Red Hat Fedora | =8 | |
| ViewVC | =1.0.2 | |
| ViewVC | =1.0.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=471380
- http://bugs.gentoo.org/show_bug.cgi?id=212288
- http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?rev=HEAD
- http://security.gentoo.org/glsa/glsa-200803-29.xml
- http://www.securityfocus.com/bid/28055
- http://secunia.com/advisories/29176
- http://secunia.com/advisories/29460
- http://www.vupen.com/english/advisories/2008/0734/references
Frequently Asked Questions
What is the severity of CVE-2008-1292?
CVE-2008-1292 is considered a high-severity vulnerability due to its potential to expose sensitive repository information.
How do I fix CVE-2008-1292?
To fix CVE-2008-1292, upgrade ViewVC to version 1.0.5 or later to ensure proper access controls are in place.
Which versions of ViewVC are affected by CVE-2008-1292?
CVE-2008-1292 affects ViewVC versions 1.0.2 and 1.0.3.
What types of sensitive information can be exposed by CVE-2008-1292?
CVE-2008-1292 can expose forbidden pathnames and log history that should not be accessible.
Is CVE-2008-1292 specific to any operating systems?
While CVE-2008-1292 primarily affects ViewVC software, it has been reported in conjunction with various operating systems, including Fedora.
- collector/nvd-historical
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/remedy
- agent/last-modified-date
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/gentoo
- canonical/gentoo linux
- vendor/redhat
- canonical/red hat fedora
- version/red hat fedora/7
- version/red hat fedora/8
- vendor/viewvc
- canonical/viewvc
- version/viewvc/1.0.2
- version/viewvc/1.0.3