CVS exploit leads to project server compromise

Tuesday, 1 June 2004, 6:21 AM EST

Users of Concurrent Versions System (CVS) software are being urged to patch their systems against an exploit used to hack the project's web site. CVS is a source code maintenance system used by many open source development projects, raising the prospect that the exploit may be used to spread compromised code to developers and end-users who download files from hacked servers.

That risk prompted an alert Friday from US-CERT, the agency coordinating U.S. cybersecurity awareness. The vulnerability in CVS, which allows a buffer overflow, was discovered May 2 by Stefan Esser of e-matters and made public, along with a patch, on May 19. While technically a "local" security hole that can only be exploited by authenticated users, most public CVS servers allow anonymous logins over the Internet. e-matters also identified a security hole in Subversion, a successor to CVS.

[ Read more ]




Spotlight

How security pros deal with cybercrime extortion

1 in 3 security professionals recommend negotiating with cybercriminals for the return of stolen data or the restoration of encrypted files. 86% of security professionals believed their peers at other organizations have brokered deals with cybercriminals.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  
DON'T
MISS

Wed, Apr 1st
    COPYRIGHT 1998-2015 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //