CVE-2004-1471: High severity Openpkg Openpkg vulnerability

Published Dec 31, 2004

Updated

Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16 allows remote attackers with CVSROOT commit access to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in a wrapper line.

Affected Software

111 affected components

Openpkg Openpkg=2.0

CVS CVS=1.11.14

CVS CVS=1.11.1

CVS CVS=1.11

CVS CVS=1.12.2

CVS CVS=1.11.4

CVS CVS=1.12.7

SGI ProPack=3.0

CVS CVS=1.12.5

Openpkg Openpkg=1.3

CVS CVS=1.11.16

CVS CVS=1.11.5

CVS CVS=1.10.8

CVS CVS=1.11.15

CVS CVS=1.11.11

Openpkg Openpkg=current

CVS CVS=1.12.8

CVS CVS=1.11.6

CVS CVS=1.12.1

CVS CVS=1.11.3

CVS CVS=1.11.2

CVS CVS=1.11.10

SGI ProPack=2.4

CVS CVS=1.10.7

CVS CVS=1.11.1_p1

FreeBSD FreeBSD=4.3-releng

FreeBSD FreeBSD=4.1.1-stable

FreeBSD FreeBSD=4.6-releng

FreeBSD FreeBSD=3.1

FreeBSD FreeBSD=4.1.1-release

FreeBSD FreeBSD=3.0-releng

FreeBSD FreeBSD=2.2.5

FreeBSD FreeBSD=5.1-releng

FreeBSD FreeBSD=4.4-stable

FreeBSD FreeBSD=4.6-stable

FreeBSD FreeBSD=4.8-release_p6

FreeBSD FreeBSD=4.6-release

FreeBSD FreeBSD=5.1-release_p5

FreeBSD FreeBSD=4.3-stable

FreeBSD FreeBSD=2.2.2

FreeBSD FreeBSD=4.7-stable

FreeBSD FreeBSD=5.2.1-releng

FreeBSD FreeBSD=5.0-release_p14

FreeBSD FreeBSD=3.5-stable

FreeBSD FreeBSD=2.2.3

FreeBSD FreeBSD=5.1-release

FreeBSD FreeBSD=4.3-release_p38

FreeBSD FreeBSD=2.0.5

FreeBSD FreeBSD=4.5-stable

FreeBSD FreeBSD=4.6-release_p20

FreeBSD FreeBSD=4.5-release

FreeBSD FreeBSD=5.0-releng

FreeBSD FreeBSD=1.1.5.1

FreeBSD FreeBSD=5.1-alpha

FreeBSD FreeBSD=4.3-release

FreeBSD FreeBSD=4.10-releng

FreeBSD FreeBSD=4.7-releng

FreeBSD FreeBSD=4.2-stable

FreeBSD FreeBSD=4.5

FreeBSD FreeBSD=3.5.1

FreeBSD FreeBSD=4.4-release_p42

FreeBSD FreeBSD=4.7

FreeBSD FreeBSD=4.1

FreeBSD FreeBSD=2.2.8

FreeBSD FreeBSD=3.5.1-stable

FreeBSD FreeBSD=4.10-release

FreeBSD FreeBSD=4.4-releng

FreeBSD FreeBSD=4.4

FreeBSD FreeBSD=4.9-releng

FreeBSD FreeBSD=5.1

FreeBSD FreeBSD=4.7-release_p17

FreeBSD FreeBSD=4.9-pre-release

FreeBSD FreeBSD=2.1.6.1

FreeBSD FreeBSD=2.2

FreeBSD FreeBSD=3.0

FreeBSD FreeBSD=4.8-pre-release

FreeBSD FreeBSD=5.2

FreeBSD FreeBSD=3.2

FreeBSD FreeBSD=4.5-release_p32

FreeBSD FreeBSD=4.8

FreeBSD FreeBSD=4.2

FreeBSD FreeBSD=2.2.4

FreeBSD FreeBSD=2.1.0

FreeBSD FreeBSD=2.2.6

FreeBSD FreeBSD=2.1.6

FreeBSD FreeBSD=2.1.7.1

FreeBSD FreeBSD=4.0-releng

Gentoo Linux=1.4

FreeBSD FreeBSD=3.3

FreeBSD FreeBSD=4.0

FreeBSD FreeBSD=4.1.1

FreeBSD FreeBSD=4.6

FreeBSD FreeBSD=4.3

FreeBSD FreeBSD=4.10

FreeBSD FreeBSD=3.4

FreeBSD FreeBSD=3.5

FreeBSD FreeBSD=5.0-alpha

FreeBSD FreeBSD=4.5-releng

OpenBSD OpenBSD=3.5

FreeBSD FreeBSD=5.2.1-release

FreeBSD FreeBSD=4.8-releng

FreeBSD FreeBSD=5.0

FreeBSD FreeBSD=2.1.5

FreeBSD FreeBSD=3.5.1-release

FreeBSD FreeBSD=4.0-alpha

OpenBSD OpenBSD=current

FreeBSD FreeBSD=4.7-release

FreeBSD FreeBSD=4.9

FreeBSD FreeBSD=4.6.2

OpenBSD OpenBSD=3.4

FreeBSD FreeBSD=2.0

Remediation

Patch Available

http://www.securityfocus.com/bid/10499

Event History

Dec 31, 2004

CVE Published

05:00 AM

Feb 13, 2005

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-1471?

CVE-2004-1471 has a high severity rating due to its potential for causing application crashes and executing arbitrary code.

How do I fix CVE-2004-1471?

To fix CVE-2004-1471, upgrade to a version of CVS that is not vulnerable, specifically versions beyond 1.12.8 and 1.11.16.

What types of systems are affected by CVE-2004-1471?

CVE-2004-1471 affects various versions of CVS, including 1.11.x and 1.12.x, as well as Openpkg and SGI ProPack implementations.

What kind of attack can CVE-2004-1471 facilitate?

CVE-2004-1471 allows remote attackers with commit access to use format string specifiers to cause crashes or execute arbitrary commands.

Is CVE-2004-1471 a local or remote vulnerability?

CVE-2004-1471 is classified as a remote vulnerability, as it can be exploited by attackers with CVSROOT commit access.