Cross-site scripting (XSS) vulnerability in the "extra" details in the DiffSource._get_row function in lib/viewvc.py in ViewVC 1.0.x before 1.0.13 and 1.1.x before 1.1.16 allows remote authenticated users with repository commit access to inject arbitrary web script or HTML via the "function name" line.

Updated viewvc packages fix security vulnerabilities :

complete authz support for remote SVN views (CVE-2012-3356).

log msg leak in SVN revision view with unreadable copy source (CVE-2012-3357).

function name lines returned by diff are not properly escaped, allowing attackers with commit access to perform cross site scripting (CVE-2012-4533).

Several other bugs were fixed as well.

Patch CVE-2012-4533.

Version 1.1.16

  - security fix: escape 'extra' diff info to avoid XSS     attack (issue #515)

    - add 'binary_mime_types' configuration option and       handling (issue #510)

    - fix 'select for diffs' persistence across log pages       (issue #512)

    - remove lock status and filesize check on directories       in remote SVN views

    - fix bogus 'Annotation of' page title for non-annotated       view (issue #514)

Version 1.1.17 (released 25-Oct-2012)

  - fix exception caused by uninitialized variable usage     (issue #516)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were found in ViewVC, a web interface for CVS and Subversion repositories.

  - CVE-2009-5024     Remote attackers can bypass the cvsdb row_limit     configuration setting, and consequently conduct     resource-consumption attacks via the limit parameter.

  - CVE-2012-3356     The remote Subversion views functionality does not     properly perform authorization, which allows remote     attackers to bypass intended access restrictions.

  - CVE-2012-3357     The Subversion revision view does not properly handle     log messages when a readable path is copied from an     unreadable path, which allows remote attackers to obtain     sensitive information.

  - CVE-2012-4533     'function name' lines returned by diff are not properly     escaped, allowing attackers with commit access to     perform cross site scripting.

ID	Name	Product	Family	Severity
66146	Mandriva Linux Security Advisory : viewvc (MDVSA-2013:134)	Nessus	Mandriva Local Security Checks	medium
63029	Fedora 18 : viewvc-1.1.17-2.fc18 (2012-16646)	Nessus	Fedora Local Security Checks	medium
62825	Fedora 17 : viewvc-1.1.17-1.fc17 (2012-16674)	Nessus	Fedora Local Security Checks	medium
62824	Fedora 16 : viewvc-1.1.17-1.fc16 (2012-16673)	Nessus	Fedora Local Security Checks	medium
62665	Debian DSA-2563-1 : viewvc - several vulnerabilities	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2012-4533

medium

Tenable Plugins

medium

medium

medium

medium

medium