=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

************************************************** *************************=
*********
Netwosix Linux Security Advisory #2004-0011 <http://www.netwosix.org>
=2D -----------------------------------------------------------------------=
=2D-----------

Package name: =A0 =A0cvs
Summary: =A0 =A0 =A0 =A0 =A0client and server vulnerabilities
Date: =A0 =A0 =A0 =A0 =A0 =A0 =A0 2004-04-18
Affected versions: Netwosix 1.0
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0Netwosix 1.1
************************************************** *************************=
*********

=2D - -> Package description:
=2D - ------------------------
CVS is the Concurrent Versions System, the dominant open-source=20
network-transparent version control system. CVS is useful for everyone fro=
m=20
individual developers to large, distributed teams:

* Its client-server access method lets developers access the latest cod=
e=20
from anywhere there's an Internet connection.
* Its unreserved check-out model to version control avoids artificial=20
conflicts common with the exclusive check-out model.
* Its client tools are available on most platforms.


=2D - -> Problem description:
=2D - ------------------------

SERVER SECURITY ISSUES

* Piped checkouts of paths above $CVSROOT no longer work. Previously, clie=
nts
could have requested the contents of RCS archive files anywhere on a CVS
server.

CLIENT SECURITY ISSUES

* Clients now check paths from the server to verify that they are within on=
e=20
of the sandboxes the user requested be updated. Previously, a trojan serv=
er
could have written or overwritten files anywhere the user had access,
presenting a serious security risk.

=2D - -> Action:
=2D - ------------------------
=A0 We recommend that all systems with this package installed be upgraded.
=A0 Please note that if you do not need the functionality provided by this
=A0 package, you may want to remove it from your system.

=2D - -> Location:
=2D - ---------------------

=A0 You can download the latest version of this package in NEPOTE format fr=
om:
=A0 <http://www.netwosix.org/0011/nepote>

=2D - -> Nepote Update:
=2D - ---------------------

See this instructions to update the port of this package:

=A0 =A0 =A0 =A0 # wget http://www.netwosix.org/0011/nepote
=A0 =A0 =A0 =A0 # sh nepote (to install the new and updated package)

=2D - -> References
=2D - ---------------------

=A0 =A0 =A0 =A0 Specific references for this advisory:
=A0 =A0 =A0 =A0 =A0 =A0 =A0http://ccvs.cvshome.org/source/browse/ccvs/NEWS?=
rev=3D1.116.2.92&content-type=3Dtext/x-cvsweb-markup


=2D - -> About Linux Netwosix:
=2D - ---------------------------------
Linux Netwosix is a powerful and optimized Linux distribution for servers
and Network Security related jobs. =A0It can also be used for special opera=
tions
such as penetration testing with its big collection of security oriented
software and sources. It's a light distribution created for the requirements
of every SysAdmin and it's very portable and highly configurable. Our
philosophy is to give greater liberty for =A0configuration to the SysAdmin.
Only in this way can he/she configure a powerful and stable server machine.
Linux Netwosix also has a powerful ports system (Nepote) similar to the xBSD
systems but more flexible and usable.


=2D - -> Questions?
=2D - ---------------------
=A0 Check out our mailing lists:
=A0 <http://www.netwosix.org/mailing.html>


=A0 The advisory itself is available at
=A0 <http://www.netwosix.org/adv11.html>
=2D - --------------------------------------------------

MD5sums of the packages:
=2D - - -------------------------------------------------------------------=
=2D------
ae866e2b76bb6322846679019209247d =A00011/nepote
63873ed6ae942b298cf1db15c85ea22e 0011/cvs-1.11.15.tar.bz2
=2D - - -------------------------------------------------------------------=
=2D------
=2D --=20
Vincenzo Ciaglia
Linux Netwosix Team - [ Keyid: 0x6BB3E24A]
Key fingerprint =3D 4B3E A25F 2A7A 0C19 1A97 616B EA3C FDA4 6BB3 E24A

=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFAgpWy6jz9pGuz4koRArsXAKCHcDyfPhzbeOJylTPaMd 7VC0jzCgCbBdzg
ORZ5Bky2FKor8iA599tII+Y=3D
=3DCYXC
=2D----END PGP SIGNATURE-----