NetSight
IP …
high7.1Public exploit code

CVE-2004-1471

Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16 allows remote attackers with CVSROOT commit access to cause a…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16 allows remote attackers with CVSROOT commit access to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in a wrapper line.

Affected products

VendorProductAffected versions
CvsCvs
Versions 1.10.7, 1.10.8, 1.11, 1.11.1, 1.11.1_p1, 1.11.2
OpenpkgOpenpkg
Versions 1.3, 2.0, current
SgiPropack
Versions 2.4, 3.0
FreebsdFreebsd
Versions 1.1.5.1, 2.0, 2.0.5, 2.1.0, 2.1.5, 2.1.6
GentooLinux
Version 1.4
OpenbsdOpenbsd
Versions 3.4, 3.5, current

References