CVE:CVE-2004-1471
CNNVD:CNNVD-200412-265
Concurrent Versions System (CVS)是一款开放源代码的版本控制软件。
CVS "Argumentx"命令存在两次释放问题，远程攻击者可以利用这个漏洞以进程权限在系统上执行任意指令。
"Argumentx" 命令允许为先前提供的参数增加更多数据，这可以通过对最后一个存储参数进行重分配来操作，但是"Argumentx"没有检查在参数列表中是否有任何参数，因为当客户端断开连接的时候程序会释放这个列表，如果列表是空的，realloc()调用就会去试图释放一个不应该被这样操作的指针。此"double-free()"漏洞在多个Linux系统上成功利用。
solution:Upgrade cvs cvs to a higher version than 1.10.7,1.10.8,1.11,1.11.1,1.11.1_p1,1.11.2,1.11.3,1.11.4,1.11.5,1.11.6,1.11.10,1.11.11,1.11.14,1.11.15,1.11.16,1.12.1,1.12.2,1.12.5,1.12.7,1.12.8,and avoid the version 1.10.7,1.10.8,1.11,1.11.1,1.11.1_p1,1.11.2,1.11.3,1.11.4,1.11.5,1.11.6,1.11.10,1.11.11,1.11.14,1.11.15,1.11.16,1.12.1,1.12.2,1.12.5,1.12.7,1.12.8; Upgrade openpkg openpkg to a higher version than 1.3,2.0,current,and avoid the version 1.3,2.0,current; Upgrade sgi propack to a higher version than 2.4,3.0,and avoid the version 2.4,3.0; Upgrade freebsd freebsd to a higher version than 1.1.5.1,2.0,2.0.5,2.1.0,2.1.5,2.1.6,2.1.6.1,2.1.7.1,2.2,2.2.2,2.2.3,2.2.4,2.2.5,2.2.6,2.2.8,3.0,3.0:releng,3.1,3.2,3.3,3.4,3.5,3.5:stable,3.5.1,3.5.1:release,3.5.1:stable,4.0,4.0:alpha,4.0:releng,4.1,4.1.1,4.1.1:release,4.1.1:stable,4.2,4.2:stable,4.3,4.3:release,4.3:release_p38,4.3:releng,4.3:stable,4.4,4.4:release_p42,4.4:releng,4.4:stable,4.5,4.5:release,4.5:release_p32,4.5:releng,4.5:stable,4.6,4.6:release,4.6:release_p20,4.6:releng,4.6:stable,4.6.2,4.7,4.7:release,4.7:release_p17,4.7:releng,4.7:stable,4.8,4.8:pre-release,4.8:release_p6,4.8:releng,4.9,4.9:pre-release,4.9:releng,4.10,4.10:release,4.10:releng,5.0,5.0:alpha,5.0:release_p14,5.0:releng,5.1,5.1:alpha,5.1:release,5.1:release_p5,5.1:releng,5.2,5.2.1:release,5.2.1:releng,and avoid the version 1.1.5.1,2.0,2.0.5,2.1.0,2.1.5,2.1.6,2.1.6.1,2.1.7.1,2.2,2.2.2,2.2.3,2.2.4,2.2.5,2.2.6,2.2.8,3.0,3.0:releng,3.1,3.2,3.3,3.4,3.5,3.5:stable,3.5.1,3.5.1:release,3.5.1:stable,4.0,4.0:alpha,4.0:releng,4.1,4.1.1,4.1.1:release,4.1.1:stable,4.2,4.2:stable,4.3,4.3:release,4.3:release_p38,4.3:releng,4.3:stable,4.4,4.4:release_p42,4.4:releng,4.4:stable,4.5,4.5:release,4.5:release_p32,4.5:releng,4.5:stable,4.6,4.6:release,4.6:release_p20,4.6:releng,4.6:stable,4.6.2,4.7,4.7:release,4.7:release_p17,4.7:releng,4.7:stable,4.8,4.8:pre-release,4.8:release_p6,4.8:releng,4.9,4.9:pre-release,4.9:releng,4.10,4.10:release,4.10:releng,5.0,5.0:alpha,5.0:release_p14,5.0:releng,5.1,5.1:alpha,5.1:release,5.1:release_p5,5.1:releng,5.2,5.2.1:release,5.2.1:releng; Upgrade gentoo linux to a higher version than 1.4,and avoid the version 1.4; Upgrade openbsd openbsd to a higher version than 3.4,3.5,current,and avoid the version 3.4,3.5,current