[38043] in bugtraq
Two Vulnerabilities in ViewCVS
daemon@ATHENA.MIT.EDU (Joxean Koret)
Sat Jan 1 17:23:29 2005
From: Joxean Koret <joxeankoret@yahoo.es>
To: Security Tracker <bugs@securitytracker.com>, Secunia <vuln@secunia.com>,
Full Disclosure <full-disclosure@lists.netsys.com>,
bugtraq@securityfocus.com
Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-CzuNC8h0LC6mJu8i4ltH"
Date: Sat, 01 Jan 2005 20:03:05 +0000
Message-Id: <1104609785.27165.0.camel@nemobox>
Mime-Version: 1.0
--=-CzuNC8h0LC6mJu8i4ltH
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable
---------------------------------------------------------------------------
Two Vulnerabilities in ViewCVS
---------------------------------------------------------------------------
Author: Jose Antonio Coret (Joxean Koret)
Date: 2004=20
Location: Basque Country
---------------------------------------------------------------------------
Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ViewCVS 0.9.2 - ViewCVS is a browser interface for CVS and Subversion
version control repositories
ViewCVS can browse directories, change logs, and revisions of files. It
can display diffs between versions and show selections of files based on
tags or branches. In addition, ViewCVS has "annotation" / "blame"
support, and Bonsai-like query facility
Web : http://viewcvs.sourceforge.net
---------------------------------------------------------------------------
Vulnerabilities:
~~~~~~~~~~~~~~~~
A. Cross Site Scripting Vulnerability and/or HTTP Response Splitting
A1. When you want to view any source file that is stored in the CVS
repository you can=20
select the mime-type to view this (in example, text/html or text/plain).
This is a=20
parameter that receives thet viewcvs.py script and is not verified.
I'm not sure if this is an HTTP Response Splitting vulnerability and/or
a Cross Site Scripting,
but is a security problem.
To try the vulnerabilities you can try the following the Proof of
Concepts:=20
Sample 1 :
~~~~~~~~~~
http://<site-with-viewcvs-092>/cgi-bin/viewcvs/project/source.file?rev=3DHE=
AD&content-type=3Dtext/html%0d%0a%0d%0a<html><body%20bgcolor=3D"black"><fon=
t%20size=3D7%20color=3Dred>XSS%20or%20HTTP%20Response%20Splitting</font></h=
tml>
Sample 2 :
~~~~~~~~~~
http://<site-with-viewcvs-092>/cgi-bin/viewcvs/*checkout*/project/source.fi=
le?rev=3D1.0&content-type=3Dtext/html%0d%0aContent-Length:1937%0d%0a%0d%0aH=
i
The fix:
~~~~~~~~
The vendor was contacted but no path for the 0.9.2 version has been
released. Anyway, the=20
problems has been fixed in the ViewCVS 1.0-dev version available via
CVS.
Disclaimer:
~~~~~~~~~~~
The information in this advisory and any of its demonstrations is
provided
"as is" without any warranty of any kind.
I am not liable for any direct or indirect damages caused as a result of
using the information or demonstrations provided in any part of this
advisory.=20
---------------------------------------------------------------------------
Contact:
~~~~~~~~
Joxean Koret at joxeanpiti<<<<<<<<@>>>>>>>>yah00<<<<<<dot>>>>>es
--=-CzuNC8h0LC6mJu8i4ltH
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQBB1wH5U6rFMEYDrlERAiXPAJ9JpDYFfliB1fb2f+/zWAxTHrmeeQCgmePh
UeKJOSjozxCKCxfZtm+kBw4=
=5nwT
-----END PGP SIGNATURE-----
--=-CzuNC8h0LC6mJu8i4ltH--
