CVE-2010-3846: Buffer Overflow
First published: Tue Oct 12 2010(Updated: )
An array index error, leading to heap-based buffer overflow was found in the way CVS version control system applied certain delta fragments changes from input file in the RCS (Revision Control System file) format. A local attacker, with access to the system controlling the repository, could store a specially-crafted RCS file into the CVS repository and trick the remote user to checkout (update their CVS repository tree) with this file, which could lead to arbitrary code execution with the privileges of the CVS server process on the system hosting the CVS repository. References: [1] <a href="http://www.gnu.org/software/rcs/">http://www.gnu.org/software/rcs/</a> Upstream changeset: [2] <a href="http://cvs.savannah.gnu.org/viewvc/cvs/ccvs/src/rcs.c?r1=1.262.4.65&r2=1.262.4.66&sortby=rev">http://cvs.savannah.gnu.org/viewvc/cvs/ccvs/src/rcs.c?r1=1.262.4.65&r2=1.262.4.66&sortby=rev</a> Acknowledgements: Red Hat would like to thank Ralph Loader for reporting this issue.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nongnu Cvs | =1.11.23 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://cvs.savannah.gnu.org/viewvc/cvs/ccvs/src/rcs.c?r1=1.262.4.65&r2=1.262.4.66&sortby=rev
- http://www.vupen.com/english/advisories/2010/2845
- https://bugzilla.redhat.com/show_bug.cgi?id=642146
- http://secunia.com/advisories/41079
- http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050090.html
- http://www.osvdb.org/68952
- http://www.redhat.com/support/errata/RHSA-2010-0918.html
- http://www.securitytracker.com/id?1024795
- http://www.vupen.com/english/advisories/2010/3080
- http://secunia.com/advisories/42409
- http://www.securityfocus.com/bid/44528
- http://www.vupen.com/english/advisories/2010/2846
- http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050212.html
- http://www.vupen.com/english/advisories/2010/2899
- http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050287.html
- http://www.vupen.com/english/advisories/2010/2869
- http://secunia.com/advisories/42041
- https://exchange.xforce.ibmcloud.com/vulnerabilities/62858
- http://www.gnu.org/software/rcs/
- https://access.redhat.com/security/cve/CVE-2010-3846
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=645386
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=642146#c41
- https://rhn.redhat.com/errata/RHSA-2010-0918.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=642146#c45
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=642146#c48
- collector/nvd-historical
- collector/nvd-index
- agent/softwarecombine
- agent/first-publish-date
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/weakness
- agent/remedy
- agent/last-modified-date
- agent/author
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2010-3846
- agent/trending
- agent/tags
- agent/source
- vendor/nongnu
- canonical/nongnu cvs
- version/nongnu cvs/1.11.23