| Vulnerability Name: | CVE-2004-0778 (CCN-17001) |
| Assigned: | 2004-06-09 |
| Published: | 2004-06-09 |
| Updated: | 2017-10-11 |
| Summary: | CVS 1.11.x before 1.11.17, and 1.12.x before 1.12.9, allows remote attackers to determine the existence of arbitrary files and directories via the -X command for an alternate history file, which causes different error messages to be returned. |
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)| Exploitability Metrics: | Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None | | Scope: | Scope (S): Unchanged
| | Impact Metrics: | Confidentiality (C): Low
Integrity (I): None
Availibility (A): None |
|
| CVSS v2 Severity: | 5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None | | Impact Metrics: | Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None |
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
| | Impact Metrics: | Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None |
|
| Vulnerability Type: | CWE-Other
|
| Vulnerability Consequences: | Obtain Information |
| References: | Source: CCN
Type: FreeBSD Security Advisory FreeBSD-SA-04:14.cvs.asc
cvs
Source: CCN
Type: CVS Web site
Project Download List
Source: MITRE
Type: CNA
CVE-2004-0778
Source: CCN
Type: RHSA-2004-233
cvs security update
Source: DEBIAN
Type: DSA-519
cvs -- several vulnerabilities
Source: IDEFENSE
Type: Vendor Advisory
20040816 CVS Undocumented Flag Information Disclosure Vulnerability
Source: CCN
Type: iDEFENSE Security Advisory 08.16.04
CVS Undocumented Flag Information Disclosure Vulnerability
Source: CCN
Type: US-CERT VU#579225
CVS history command may disclose sensitive information
Source: CERT-VN
Type: Patch, Third Party Advisory, US Government Resource
VU#579225
Source: MANDRAKE
Type: UNKNOWN
MDKSA-2004:108
Source: BID
Type: Patch, Vendor Advisory
10955
Source: CCN
Type: BID-10955
CVS Undocumented History Flag Information Disclosure Vulnerability
Source: XF
Type: UNKNOWN
cvs-history-info-disclosure(17001)
Source: XF
Type: UNKNOWN
cvs-history-info-disclosure(17001)
Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:10688
|
| Vulnerable Configuration: | Configuration 1:
cpe:/a:cvs:cvs:1.10.6:*:*:*:*:*:*:*OR cpe:/a:cvs:cvs:1.10.7:*:*:*:*:*:*:*OR cpe:/a:cvs:cvs:1.10.8:*:*:*:*:*:*:*OR cpe:/a:cvs:cvs:1.11:*:*:*:*:*:*:*OR cpe:/a:cvs:cvs:1.11.1:*:*:*:*:*:*:*OR cpe:/a:cvs:cvs:1.11.1_p1:*:*:*:*:*:*:*OR cpe:/a:cvs:cvs:1.11.2:*:*:*:*:*:*:*OR cpe:/a:cvs:cvs:1.11.3:*:*:*:*:*:*:*OR cpe:/a:cvs:cvs:1.11.4:*:*:*:*:*:*:*OR cpe:/a:cvs:cvs:1.11.5:*:*:*:*:*:*:*OR cpe:/a:cvs:cvs:1.11.6:*:*:*:*:*:*:*OR cpe:/a:cvs:cvs:1.11.10:*:*:*:*:*:*:*OR cpe:/a:cvs:cvs:1.11.11:*:*:*:*:*:*:*OR cpe:/a:cvs:cvs:1.11.14:*:*:*:*:*:*:*OR cpe:/a:cvs:cvs:1.11.15:*:*:*:*:*:*:*OR cpe:/a:cvs:cvs:1.11.16:*:*:*:*:*:*:*OR cpe:/a:cvs:cvs:1.12.1:*:*:*:*:*:*:*OR cpe:/a:cvs:cvs:1.12.2:*:*:*:*:*:*:*OR cpe:/a:cvs:cvs:1.12.5:*:*:*:*:*:*:*OR cpe:/a:cvs:cvs:1.12.7:*:*:*:*:*:*:*OR cpe:/a:cvs:cvs:1.12.8:*:*:*:*:*:*:*
Configuration RedHat 1:
cpe:/o:redhat:enterprise_linux:*:*:*:*:*:*:*:*
 Denotes that component is vulnerable |
| Oval Definitions |
| Definition ID | Class | Title | Last Modified |
|---|
| oval:org.mitre.oval:def:10688 | V | CVS 1.11.x before 1.11.17, and 1.12.x before 1.12.9, allows remote attackers to determine the existence of arbitrary files and directories via the -X command for an alternate history file, which causes different error messages to be returned. | 2013-04-29 | | oval:org.debian:def:519 | V | several vulnerabilities | 2004-06-15 | | oval:com.redhat.rhsa:def:20040233 | P | RHSA-2004:233: cvs security update (Critical) | 2004-06-09 |
|
| BACK |