| VID |
23048 |
| Severity |
20 |
| Port |
2401 |
| Protocol |
TCP |
| Class |
CVS |
| Detailed Description |
A CVS pserver is detected as running. CVS (Concurrent Versions System) is an open-source source code management and distribution system available for most Linux and Unix-based operating systems. This service starts as a daemon (cvspserver), typically listening on port 2401/tcp. Knowing that a CVS server is present on the system gives attackers additional information about the system, such as that this is a UNIX based system, and maybe a starting point for further attacks.
* Platforms Affected:
CVS (Concurrent Versions System) Any version
Linux Any version
UNIX Any version |
| Recommendation |
Disable CVS pserver if it is not needed. If the CVS daemon is started from inetd.conf, comment its entry by putting a # at the beginning of the line. If it is started from the rc script, comment it out as appropriate for your operating system.
-- OR --
Block access to CVS servers from untrusted networks |
| Related URL |
(CVE) |
| Related URL |
(SecurityFocus) |
| Related URL |
(ISS) |
|
