CVE-2010-3846: Buffer Overflow
An array index error, leading to heap-based buffer overflow was found in the way CVS version control system applied certain delta fragments changes from input file in the RCS (Revision Control System file) format. A local attacker, with access to the system controlling the repository, could store a specially-crafted RCS file into the CVS repository and trick the remote user to checkout (update their CVS repository tree) with this file, which could lead to arbitrary code execution with the privileges of the CVS server process on the system hosting the CVS repository.
References: [1] http://www.gnu.org/software/rcs/
Upstream changeset: [2] http://cvs.savannah.gnu.org/viewvc/cvs/ccvs/src/rcs.c?r1=1.262.4.65&r2=1.262.4.66&sortby=rev
Acknowledgements:
Red Hat would like to thank Ralph Loader for reporting this issue.
Other sources
Array index error in the applyrcschange function in rcs.c in CVS 1.11.23 allows local users to gain privileges via an RCS file containing crafted delta fragment changes that trigger a heap-based buffer overflow.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3846?
CVE-2010-3846 has been classified as a high severity vulnerability due to its potential for local code execution via heap-based buffer overflow.
How do I fix CVE-2010-3846?
To fix CVE-2010-3846, upgrade to a patched version of CVS that addresses this heap-based buffer overflow issue.
What versions of CVS are affected by CVE-2010-3846?
CVE-2010-3846 specifically affects CVS version 1.11.23.
Can CVE-2010-3846 be exploited remotely?
CVE-2010-3846 requires local access to the system controlling the CVS repository for exploitation.
What type of vulnerability is CVE-2010-3846?
CVE-2010-3846 is an array index error that leads to a heap-based buffer overflow in the way CVS processes certain delta fragments.