REDHAT-BUG-642146: Buffer Overflow
An array index error, leading to heap-based buffer overflow was found in the way CVS version control system applied certain delta fragments changes from input file in the RCS (Revision Control System file) format. A local attacker, with access to the system controlling the repository, could store a specially-crafted RCS file into the CVS repository and trick the remote user to checkout (update their CVS repository tree) with this file, which could lead to arbitrary code execution with the privileges of the CVS server process on the system hosting the CVS repository.
References: [1] http://www.gnu.org/software/rcs/
Upstream changeset: [2] http://cvs.savannah.gnu.org/viewvc/cvs/ccvs/src/rcs.c?r1=1.262.4.65&r2=1.262.4.66&sortby=rev
Acknowledgements:
Red Hat would like to thank Ralph Loader for reporting this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-642146?
The severity of REDHAT-BUG-642146 is considered high due to the potential for a heap-based buffer overflow.
How do I fix REDHAT-BUG-642146?
To fix REDHAT-BUG-642146, update to the latest version of GNU CVS that is not affected by the vulnerability.
Who is affected by REDHAT-BUG-642146?
Local attackers with access to systems running affected versions of GNU CVS are at risk from REDHAT-BUG-642146.
What is the nature of REDHAT-BUG-642146?
REDHAT-BUG-642146 is an array index error that leads to a heap-based buffer overflow in GNU CVS.
What versions of CVS are vulnerable to REDHAT-BUG-642146?
Versions between 1.262.4.65 and 1.262.4.66 of GNU CVS are affected by REDHAT-BUG-642146.