Jesse Keating
05/06/04, 08:15
=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=2D -----------------------------------------------------------------------
Fedora Legacy Update Advisory
Synopsis: Updated cvs resolves security vulnerability
Advisory ID: FLSA:1620
Issue date: 2004-06-02
Product: Red Hat Linux
Keywords: Security
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=3D1620
CVE Names: CAN-2004-0180 CAN-2004-0396 CAN-2004-0405
=2D -----------------------------------------------------------------------
=2D ---------------------------------------------------------------------
1. Topic:
Updated cvs packages that fix remote denial of service vulnerabilities are=
=20
now available.
2. Relevent releases/architectures:
Red Hat Linux 7.3 - i386
Red Hat Linux 9 - i386
3. Problem description:
Sebastian Krahmer discovered a flaw in CVS clients where rcs diff files can=
=20
create files with absolute pathnames An attacker could create a fake=20
malicious CVS server that would cause arbitrary files to be created or=20
overwritten when a victim connects to it. The Common Vulnerabilities and=20
Exposures project (cve.mitre.org) has assigned the name CAN-2004-0180 to=20
this issue. (Note: Red Hat Linux 9 was already patched for this issue)
Derek Price discovered a vulnerability whereby a CVS pserver could be=20
abused by a malicious client to view the contents of certain files outside=
=20
of the CVS root directory using relative pathnames containing "../". The=20
Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned=20
the name CAN-2004-0405 to this issue. (Note: Red Hat Linux 9 was already=20
patched for this issue)
Stefan Esser discovered a flaw in cvs where malformed "Entry" lines could=20
cause a heap overflow. An attacker who has access to a CVS server could=20
use this flaw to execute arbitrary code under the UID which the CVS server=
=20
is executing. The Common Vulnerabilities and Exposures project=20
(cve.mitre.org) has assigned the name CAN-2004-0396 to this issue.
Users of CVS are advised to upgrade to these erratum packages, which=20
contain a patch correcting this issue.
=46edora Legacy would like to thank David M. Kaplan for bringing these issu=
es=20
to our attention.
4. Solution:
Before applying this update, make sure all previously released errata=20
relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. Only those=20
RPMs which are currently installed will be updated. Those RPMs which are=20
not installed but included in the list will not be updated. Note that you=
=20
can also use wildcards (*.rpm) if your current directory *only* contains=20
the desired RPMs.
Please note that this update is also available via yum and apt. Many=20
people find this an easier way to apply updates. To use yum issue:
yum update
or to use apt:
apt-get update; apt-get upgrade
This will start an interactive process that will result in the appropriate=
=20
RPMs being upgraded on your system. This assumes that you have yum or=20
apt-get configured for obtaining Fedora Legacy content. Please visit=20
http://www fedoralegacy.org/docs for directions on how to configure yum=20
and apt-get.
5. Bug IDs fixed:
http://bugzilla.fedora.us - 1620 - Security problems found with CVS that=20
need to be fixed.
6. RPMs required:
Red Hat Linux 7.3:
SRPM:
http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/cvs-1.11.1p1-14.l=
egacy.3.src.rpm
i386:
http://download.fedoralegacy.org/redhat/7.3/updates/i386/cvs-1.11.1p1-14.le=
gacy.3.i386.rpm
Red Hat Linux 9:
SRPM:
http://download.fedoralegacy.org/redhat/9/updates/SRPMS/cvs-1.11.2-23.legac=
y.src.rpm
i386:
http://download.fedoralegacy.org/redhat/9/updates/i386/cvs-1.11.2-23.legacy=
=2Ei386.rpm
7. Verification:
SHA1 sum Package Name
=2D -----------------------------------------------------------------------=
=2D---
58069558fc24abfa50f2ac94327c8d06f234bbd9 =20
7.3/updates/SRPMS/cvs-1.11.1p1-14.legacy.3.src.rpm
523e9f69536d69ae5a8984f4327e35b32c38afdc =20
7.3/updates/i386/cvs-1.11.1p1-14.legacy.3.i386.rpm
84027d8b84f72c675aeb15816034e86450534b62 =20
9/updates/SRPMS/cvs-1.11.2-23.legacy.src.rpm
e79bb82a8dca7a50cf51a72a85879bdbfa0b338d =20
9/updates/i386/cvs-1.11.2-23.legacy.i386.rpm
These packages are GPG signed by Fedora Legacy for security. Our key is=20
available from http://www.fedoralegacy org/about/security.php
You can verify each package with the following command:
rpm --checksig -v <filename>
If you only wish to verify that each package has not been corrupted or=20
tampered with, examine only the sha1sum with the following command:
sha1sum <filename>
8. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCAN-2004-0180
http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCAN-2004-0396
http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCAN-2004-0405
http://rhn.redhat.com/errata/RHSA-2004-153.html
http://rhn.redhat.com/errata/RHSA-2004-190.html
http://rhn.redhat.com/errata/RHSA-2004-154.html
https://bugzilla.fedora.us/show_bug.cgi?id=3D1620
9. Contact:
The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More=20
project details at http://www.fedoralegacy.org
=2D ---------------------------------------------------------------------
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFAwBaq4v2HLvE71NURAvsNAJ9SSg36GQyr20SYyCtS4w bOKr3wygCgsZJ+
h2yNelOC3+SW9wW+n38K9Lw=3D
=3DMY5k
=2D----END PGP SIGNATURE-----
Hash: SHA1
=2D -----------------------------------------------------------------------
Fedora Legacy Update Advisory
Synopsis: Updated cvs resolves security vulnerability
Advisory ID: FLSA:1620
Issue date: 2004-06-02
Product: Red Hat Linux
Keywords: Security
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=3D1620
CVE Names: CAN-2004-0180 CAN-2004-0396 CAN-2004-0405
=2D -----------------------------------------------------------------------
=2D ---------------------------------------------------------------------
1. Topic:
Updated cvs packages that fix remote denial of service vulnerabilities are=
=20
now available.
2. Relevent releases/architectures:
Red Hat Linux 7.3 - i386
Red Hat Linux 9 - i386
3. Problem description:
Sebastian Krahmer discovered a flaw in CVS clients where rcs diff files can=
=20
create files with absolute pathnames An attacker could create a fake=20
malicious CVS server that would cause arbitrary files to be created or=20
overwritten when a victim connects to it. The Common Vulnerabilities and=20
Exposures project (cve.mitre.org) has assigned the name CAN-2004-0180 to=20
this issue. (Note: Red Hat Linux 9 was already patched for this issue)
Derek Price discovered a vulnerability whereby a CVS pserver could be=20
abused by a malicious client to view the contents of certain files outside=
=20
of the CVS root directory using relative pathnames containing "../". The=20
Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned=20
the name CAN-2004-0405 to this issue. (Note: Red Hat Linux 9 was already=20
patched for this issue)
Stefan Esser discovered a flaw in cvs where malformed "Entry" lines could=20
cause a heap overflow. An attacker who has access to a CVS server could=20
use this flaw to execute arbitrary code under the UID which the CVS server=
=20
is executing. The Common Vulnerabilities and Exposures project=20
(cve.mitre.org) has assigned the name CAN-2004-0396 to this issue.
Users of CVS are advised to upgrade to these erratum packages, which=20
contain a patch correcting this issue.
=46edora Legacy would like to thank David M. Kaplan for bringing these issu=
es=20
to our attention.
4. Solution:
Before applying this update, make sure all previously released errata=20
relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. Only those=20
RPMs which are currently installed will be updated. Those RPMs which are=20
not installed but included in the list will not be updated. Note that you=
=20
can also use wildcards (*.rpm) if your current directory *only* contains=20
the desired RPMs.
Please note that this update is also available via yum and apt. Many=20
people find this an easier way to apply updates. To use yum issue:
yum update
or to use apt:
apt-get update; apt-get upgrade
This will start an interactive process that will result in the appropriate=
=20
RPMs being upgraded on your system. This assumes that you have yum or=20
apt-get configured for obtaining Fedora Legacy content. Please visit=20
http://www fedoralegacy.org/docs for directions on how to configure yum=20
and apt-get.
5. Bug IDs fixed:
http://bugzilla.fedora.us - 1620 - Security problems found with CVS that=20
need to be fixed.
6. RPMs required:
Red Hat Linux 7.3:
SRPM:
http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/cvs-1.11.1p1-14.l=
egacy.3.src.rpm
i386:
http://download.fedoralegacy.org/redhat/7.3/updates/i386/cvs-1.11.1p1-14.le=
gacy.3.i386.rpm
Red Hat Linux 9:
SRPM:
http://download.fedoralegacy.org/redhat/9/updates/SRPMS/cvs-1.11.2-23.legac=
y.src.rpm
i386:
http://download.fedoralegacy.org/redhat/9/updates/i386/cvs-1.11.2-23.legacy=
=2Ei386.rpm
7. Verification:
SHA1 sum Package Name
=2D -----------------------------------------------------------------------=
=2D---
58069558fc24abfa50f2ac94327c8d06f234bbd9 =20
7.3/updates/SRPMS/cvs-1.11.1p1-14.legacy.3.src.rpm
523e9f69536d69ae5a8984f4327e35b32c38afdc =20
7.3/updates/i386/cvs-1.11.1p1-14.legacy.3.i386.rpm
84027d8b84f72c675aeb15816034e86450534b62 =20
9/updates/SRPMS/cvs-1.11.2-23.legacy.src.rpm
e79bb82a8dca7a50cf51a72a85879bdbfa0b338d =20
9/updates/i386/cvs-1.11.2-23.legacy.i386.rpm
These packages are GPG signed by Fedora Legacy for security. Our key is=20
available from http://www.fedoralegacy org/about/security.php
You can verify each package with the following command:
rpm --checksig -v <filename>
If you only wish to verify that each package has not been corrupted or=20
tampered with, examine only the sha1sum with the following command:
sha1sum <filename>
8. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCAN-2004-0180
http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCAN-2004-0396
http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCAN-2004-0405
http://rhn.redhat.com/errata/RHSA-2004-153.html
http://rhn.redhat.com/errata/RHSA-2004-190.html
http://rhn.redhat.com/errata/RHSA-2004-154.html
https://bugzilla.fedora.us/show_bug.cgi?id=3D1620
9. Contact:
The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More=20
project details at http://www.fedoralegacy.org
=2D ---------------------------------------------------------------------
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFAwBaq4v2HLvE71NURAvsNAJ9SSg36GQyr20SYyCtS4w bOKr3wygCgsZJ+
h2yNelOC3+SW9wW+n38K9Lw=3D
=3DMY5k
=2D----END PGP SIGNATURE-----