bugtraq - GLSA: cvs (200312-08)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <a05210602bc158605f570@[10.96.0.12]>
Date: Mon, 29 Dec 2003 02:21:15 -0500
From: Rajiv Aaron Manglani <rajiv@...too.org>
To: bugtraq@...urityfocus.com
Subject: GLSA: cvs (200312-08)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200312-08
- --------------------------------------------------------------------------

GLSA:        200312-08
package:     dev-util/cvs
summary:     Fix for possible root compromise when using CVS pserver
severity:    high
Gentoo bug:  36142
date:        2003-12-28
exploit:     unknown
affected:    <=1.11.10
fixed:       >=1.11.11

DESCRIPTION:

Quote from <http://ccvs.cvshome.org/servlets/NewsItemView?newsID=88>:

   "Stable CVS 1.11.11 has been released. Stable releases contain only
   bug fixes from previous versions of CVS. This release adds code to
   the CVS server to prevent it from continuing as root after a user
   login, as an extra failsafe against a compromise of the
   CVSROOT/passwd file. Previously, any user with the ability to write
   the CVSROOT/passwd file could execute arbitrary code as the root
   user on systems with CVS pserver access enabled. We recommend this
   upgrade for all CVS servers!"

SOLUTION:

All Gentoo Linux machines with cvs installed should be updated to use
cvs-1.11.11 or higher.

        emerge sync
        emerge -pv '>=dev-util/cvs-1.11.11'
        emerge '>=dev-util/cvs-1.11.11'
        emerge clean

// end

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (Darwin)

iD8DBQE/79SAnt0v0zAqOHYRAuWTAJ9UY/lAvsKQRtHLQZr/zDUf5eok6wCgumZt
ICbAjuPbALouwsdG16pqS6s=
=UQlf
-----END PGP SIGNATURE-----