Debian DSA-2563-1 : viewvc - several vulnerabilities

medium Nessus Plugin ID 62665

Language:

Synopsis

The remote Debian host is missing a security-related update.

Description

Several vulnerabilities were found in ViewVC, a web interface for CVS and Subversion repositories.

- CVE-2009-5024 Remote attackers can bypass the cvsdb row_limit configuration setting, and consequently conduct resource-consumption attacks via the limit parameter.

- CVE-2012-3356 The remote Subversion views functionality does not properly perform authorization, which allows remote attackers to bypass intended access restrictions.

- CVE-2012-3357 The Subversion revision view does not properly handle log messages when a readable path is copied from an unreadable path, which allows remote attackers to obtain sensitive information.

- CVE-2012-4533 'function name' lines returned by diff are not properly escaped, allowing attackers with commit access to perform cross site scripting.

Solution

Upgrade the viewvc packages.

For the stable distribution (squeeze), these problems have been fixed in version 1.1.5-1.1+squeeze2.

Plugin Details

Severity: Medium

ID: 62665

File Name: debian_DSA-2563.nasl

Version: 1.12

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 10/24/2012

Updated: 1/11/2021

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.7

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Information

CPE: cpe:/o:debian:debian_linux:6.0, p-cpe:/a:debian:debian_linux:viewvc

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 10/23/2012

Reference Information

CVE: CVE-2009-5024, CVE-2012-3356, CVE-2012-3357, CVE-2012-4533

BID: 47928, 54197, 54199, 56161

DSA: 2563

Detections

Analytics