cvsbug in CVS 1.12.12 and earlier creates temporary files insecurely, which allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack.

Problem description

A temporary file is created, used, deleted, and then re-created with the same name. This creates a window during which an attacker could replace the file with a link to another file. While cvsbug(1) is based on the send-pr(1) utility, this problem does not exist in the version of send-pr(1) distributed with FreeBSD. In FreeBSD 4.10 and 5.3, some additional problems exist concerning temporary file usage in both cvsbug(1) and send-pr(1).

Impact

A local attacker could cause data to be written to any file to which the user running cvsbug(1) (or send-pr(1) in FreeBSD 4.10 and 5.3) has write access. This may cause damage in itself (e.g., by destroying important system files or documents) or may be used to obtain elevated privileges.

Workaround

Do not use the cvsbug(1) utility on any system with untrusted users.
Do not use the send-pr(1) utility on a FreeBSD 4.10 or 5.3 system with untrusted users.

An updated cvs package that fixes a security bug is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

CVS (Concurrent Version System) is a version control system.

An insecure temporary file usage was found in the cvsbug program. It is possible that a local user could leverage this issue to execute arbitrary instructions as the user running cvsbug. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2693 to this issue.

All users of cvs should upgrade to this updated package, which includes a patch to correct this issue.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2005:756 advisory.

    CVS (Concurrent Version System) is a version control system.

    An insecure temporary file usage was found in the cvsbug program.  It is     possible that a local user could leverage this issue to execute arbitrary     instructions as the user running cvsbug.  The Common Vulnerabilities and     Exposures project assigned the name CAN-2005-2693 to this issue.

    All users of cvs should upgrade to this updated package, which includes a     patch to correct this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Marcus Meissner discovered that the cvsbug program from gcvs, the Graphical frontend for CVS, which serves the popular Concurrent Versions System, uses temporary files in an insecure fashion.

Marcus Meissner discovered that the cvsbug program from CVS, which serves the popular Concurrent Versions System, uses temporary files in an insecure fashion.

ID	Name	Product	Family	Severity
23666	FreeBSD : cvsbug -- race condition (c5c17ead-8f23-11da-8c1d-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	medium
21853	CentOS 3 / 4 : cvs (CESA-2005:756)	Nessus	CentOS Local Security Checks	medium
19674	RHEL 4 : cvs (RHSA-2005:756)	Nessus	Red Hat Local Security Checks	high
19613	Debian DSA-806-1 : gcvs - insecure temporary files	Nessus	Debian Local Security Checks	medium
19609	Debian DSA-802-1 : cvs - insecure temporary files	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2005-2693

high

Tenable Plugins

medium

medium

high

medium

medium