Bug 647302 (CVE-2010-4098)

Summary:	CVE-2010-4098 monotone: remote DoS via empty arg to mtn command
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	thomas.moschny
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-12-03 17:19:24 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	647303
Bug Blocks:

Description Vincent Danen 2010-10-27 20:26:59 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2010-4098 to
the following vulnerability:

Name: CVE-2010-4098
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4098
Assigned: 20101027
Reference: CONFIRM: http://www.monotone.ca/NEWS
Reference: BID:44383
Reference: URL: http://www.securityfocus.com/bid/44383
Reference: SECUNIA:41960
Reference: URL: http://secunia.com/advisories/41960
Reference: XF:monotone-commands-dos(62758)
Reference: URL: http://xforce.iss.net/xforce/xfdb/62758

monotone before 0.48.1, when configured to allow remote commands,
allows remote attackers to cause a denial of service (crash) via an
empty argument to the mtn command.


Fedora 13 and later have monotone 0.48.1, however Fedora 12 currently provides 0.45 and EPEL5 provides 0.42, so both of those versions require updates.

Comment 1 Vincent Danen 2010-10-27 20:27:47 UTC

Created monotone tracking bugs for this issue

Affects: fedora-12 [bug 647303]

Comment 2 Thomas Moschny 2010-10-27 23:38:17 UTC

Affected are F-13, F-14, Rawhide and EPEL-6, all currently on 0.48. Working on those now.

Neither F-12 nor EPEL-5 are affected, as the 'remote' and 'remote_stdio' commands have been introduced in 0.46 (see http://www.monotone.ca/NEWS), so the bug only affects 0.46-0.48.

Comment 3 Thomas Moschny 2010-10-28 00:35:49 UTC

Updated packages in Rawhide and EPEL-6, submitted updates for F-13 and F14.

Comment 4 Vincent Danen 2010-10-28 03:55:08 UTC

Sorry, I read my output wrong and thought F13+ were at 0.48.1 already (but they were at 0.48-1 instead).  Thanks for catching that and submitting the appropriate updates.

Comment 5 Thomas Moschny 2010-12-03 17:19:24 UTC

Meanwhile, F13 and F14 updates have hit updates-stable, closing.