[Debian-sf-users] cvsweb and CVE-2000-0670

[Lee Sheridan]

Hi.  I'm setting up a SF site, based on the current debian-sf 2.6 out of
CVS.

Part of our local policy for newly network attached systems is an ISS or
Nessus scan.  Nessus is complaining that "The remote cvsweb is older or
as old as version 1.85", and points to CVE-2000-0670.

The Bugtraq message is here:

  http://www.securityfocus.com/archive/1/69942/2000-07-06/2000-07-12/0

Looking at the sf code, I see that parts of cvsweb were integrated into
the Debian tree.

Quoting /sourceforge-2.6/deb-specific/cvsweb/cvsweb.cgi:

 # Based on:
 # * Bill Fenners cvsweb.cgi revision 1.28 available from:
 #   http://www.freebsd.org/cgi/cvsweb.cgi/www/en/cgi/cvsweb.cgi

So my question is -- was this vulnerability patched in the debian-sf
branch of the cvsweb code, or irrelavent in the debian-sf code?  I admit
to not being a good enough coder to confidently proclaim that I consider
it to be a false positive.

Thanks in advance.

-- 
Lee Sheridan                            301.286.5898 voice
NASA / Goddard Space Flight Center      address@hidden
Computer Sciences Corporation           Building 28, Room S241
Code 931