internetnews.com: More Trouble for Flawed CVS

“In a security advisory issued today, iDefense announced the
discovery of yet another Concurrent Versions System (CVS) flaw.

“According to the security research firm’s advisory, the
‘Undocumented Flag Information Disclosure Vulnerability’ allows for
the remote exploitation of an information disclosure vulnerability
in CVS that ‘allows attackers to glean information.’ In their
analysis, the successful execution of the exploit would allow an
attacker to gain credentials to the CVS server, which would permit
them to determine, ‘whether or not arbitrary system files and
directories exist and are accessible under the permissions of the
user that the CVS daemon runs under…'”

Complete
Story