Date: Thu, 11 Dec 2003 13:52:45 -0800 (PST)
From: Slackware Security Team <[email protected]>
To: [email protected]Subject: [slackware-security] cvs security update (SSA:2003-345-01)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
[slackware-security] cvs security update (SSA:2003-345-01)
CVS is a client/server version control system. As a server, it
is used to host source code repositories. As a client, it is
used to access such repositories. This advisory deals with the
use of CVS as a server.
A security problem which could allow an attacker to create
directories and possibly files outside of the CVS repository has
been fixed with the release of cvs-1.11.10. Any sites running a
CVS server should upgrade to the new CVS package.
Here are the details from the Slackware 9.1 ChangeLog:
+--------------------------+
Thu Dec 11 12:29:30 PST 2003
patches/packages/cvs-1.11.10-i486-1.tgz: Upgraded to cvs-1.11.10.
- From the NEWS file:
SERVER SECURITY ISSUES
* Malformed module requests could cause the CVS server to attempt to
create directories and possibly files at the root of the filesystem
holding the CVS repository. Filesystem permissions usually prevent
the creation of these misplaced directories, but nevertheless, the
CVS server now rejects the malformed requests.
(* Security fix *)
+--------------------------+
WHERE TO FIND THE NEW PACKAGE:
+-----------------------------+
Updated package for Slackware 8.1:
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/cvs-1.11.10-i386-1.tgz
Updated package for Slackware 9.0:
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/cvs-1.11.10-i386-1.tgz
Updated package for Slackware 9.1:
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/cvs-1.11.10-i486-1.tgz
Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/d/cvs-1.11.10-i486-1.tgz
MD5 SIGNATURES:
+-------------+
Slackware 8.1 package:
1aff9e868759883f160f7d75800cef63 cvs-1.11.10-i386-1.tgz
Slackware 9.0 package:
fa213d474908fe0cabd9d41270867eb1 cvs-1.11.10-i386-1.tgz
Slackware 9.1 package:
e8b66036e4338e18e8d793c1c2b3e3a3 cvs-1.11.10-i486-1.tgz
Slackware -current package:
422e1586900f6bf1c363c240fc0368b1 cvs-1.11.10-i486-1.tgz
INSTALLATION INSTRUCTIONS:
+------------------------+
First, shut down the cvs server if you are running one.
Then, upgrade the package:
# upgradepkg cvs-1.11.10-i486-1.tgz
Finally, restart the CVS server.
+-----+
Slackware Linux Security Team
http://slackware.com/gpg-key[email protected]
+------------------------------------------------------------------------+
| HOW TO REMOVE YOURSELF FROM THIS MAILING LIST: |
+------------------------------------------------------------------------+
| Send an email to [email protected] with this text in the body of |
| the email message: |
| |
| unsubscribe slackware-security |
| |
| You will get a confirmation message back. Follow the instructions to |
| complete the unsubscription. Do not reply to this message to |
| unsubscribe! |
+------------------------------------------------------------------------+
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)
iD8DBQE/2NpcakRjwEAQIjMRArp7AJ9RO8jbRHBWOILUlheJ1l2SDbszXACfb7eD
FJ4g//Rx7P1/Qn30Fz2PThs=
=UvJg
-----END PGP SIGNATURE-----
