426690 – (CVE-2012-3356) <www-apps/viewvc-1.1.17: two security flaws fixed in 1.1.15 (CVE-2012-{3356,3357})

Bug 426690 (CVE-2012-3356) - <www-apps/viewvc-1.1.17: two security flaws fixed in 1.1.15 (CVE-2012-{3356,3357})

Summary: <www-apps/viewvc-1.1.17: two security flaws fixed in 1.1.15 (CVE-2012-{3356,3...

Status:	RESOLVED FIXED

Alias:	CVE-2012-3356

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor (vote)
Assignee:	Gentoo Security

URL:	http://viewvc.tigris.org/issues/show_...
Whiteboard:	B4 [noglsa]
Keywords:

Depends on:	CVE-2012-4533
Blocks:
	Show dependency tree

Reported:	2012-07-15 10:34 UTC by the_eccentric
Modified:	2012-12-11 17:33 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description the_eccentric 2012-07-15 10:34:47 UTC

ViewVC 1.1.15 was released [1] with the following fixes:

* security fix: complete authz support for remote SVN views (issue #353)
* security fix: log msg leak in SVN revision view with unreadable copy source

The SUSE bug report [2] notes some possible source fixes for these issues:

The first one:
http://viewvc.tigris.org/issues/show_bug.cgi?id=353
http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2755
http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2756
http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2757
http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2759
http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2760

The second flaw:
http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2758

[1] http://viewvc.tigris.org/source/browse/*checkout*/viewvc/tags/1.1.15/CHANGES
[2] https://bugzilla.novell.com/show_bug.cgi?id=768680

Reproducible: Always

Comment 1 GLSAMaker/CVETool Bot gentoo-dev

2012-07-23 19:20:22 UTC

CVE-2012-3357 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3357):
  The SVN revision view (lib/vclib/svn/svn_repos.py) in ViewVC before 1.1.15
  does not properly handle log messages when a readable path is copied from an
  unreadable path, which allows remote attackers to obtain sensitive
  information, related to a "log msg leak."

CVE-2012-3356 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3356):
  The remote SVN views functionality (lib/vclib/svn/svn_ra.py) in ViewVC
  before 1.1.15 does not properly perform authorization, which allows remote
  attackers to bypass intended access restrictions via unspecified vectors.

Comment 2 Sean Amoss (RETIRED) gentoo-dev

2012-11-10 19:53:12 UTC

web-apps: ping

Please bump for this bug and bug 440774.

Comment 3 Anthony Basile gentoo-dev

2012-11-11 01:47:35 UTC

Bumped to viewvc-1.1.17.  This should also take care of bug 440774.

Comment 4 Sean Amoss (RETIRED) gentoo-dev

2012-11-11 13:41:40 UTC

(In reply to comment #3)
> Bumped to viewvc-1.1.17.  This should also take care of bug 440774.

Thanks, Anthony.

Comment 5 Sean Amoss (RETIRED) gentoo-dev

2012-11-12 22:16:15 UTC

GLSA vote: no.

Comment 6 Tim Sammut (RETIRED) gentoo-dev

2012-12-11 17:33:53 UTC

GLSA Vote: no, too. Closing noglsa.