Check Point Advisories

CVS Entry Line Flag Remote Heap Overflow - Ver2 (CVE-2004-0396)

Vulnerability
Protection

Check Point Reference:	CPAI-2014-2433
Date Published:	28 Dec 2014
Severity:	High
Last Updated:	Sunday 28 December, 2014
Source:
Industry Reference:	CVE-2004-0396
Protection Provided by:	Security Gateway R77, R76, R75
Who is Vulnerable?
Vulnerability Description	Concurrent Versions System (CVS) is an open-source network-transparent version control system. CVS itself does not listen for, or accept network connections. To implement remote repository access, it can be installed as an inetd service, or invoked with the rsh/ssh command. Data between the server and client is then piped to standard in/out file handles. When CVS is invoked by inetd, it will be passed a "pserver" or a "kserver" command line argument, which indicates the utilization of a built-in password authentication or Kerberos authentication, respectively. When accessed by rsh/ssh, the user authentication is done through the rsh/ssh log-in, CVS will then be invoked as "cvs server". In all cases, the code steps into the same service function after authentication has succeeded. A vulnerability exists in the way CVS handles a CVS line to decide whether or not a flag will be attached. The vulnerability is caused by a failure to handle invalid input parameters for certain flags in an entry line of a CVS request. Exploitation of this vulnerability leads to heap memory overflow and it is possible for an attacker to run arbitrary code on the CVS server. Because CVS uses Xinetd as the underlying network daemon, in a successful attack case the vulnerable system can be compromised without any change in behaviour. The service will still be functioning. In the case of a shell code execution, the actual behaviour is dependant on the shell code injected by the exploit.

Protection Overview

This protection will detect and block attempts to exploit this vulnerability.

In order for the protection to be activated,
update your Security Gateway product to the latest IPS update.
For information on how to update IPS, go to

SBP-2006-05,
Protection tab and select the version of your choice.

Security Gateway R77 / R76 / R75 / R71 / R70

In the IPS tab, click Protections and find the CVS Entry Line Flag Remote Heap Overflow - Ver2 protection using the Search tool and Edit the protection's settings.
Install policy on all modules.

SmartView Tracker will log the following entries:

Attack Name: HTTP Protocol Inspection.
Attack Information: CVS Entry Line Flag Remote Heap Overflow - Ver2