glsa-200312-08.xml


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsa id="200312-08">
  <title>CVS: possible root compromise when using CVS pserver</title>
  <synopsis>
    A possible root compromise exists for CVS pservers.
  </synopsis>
  <product type="ebuild">cvs</product>
  <announced>2003-12-28</announced>
  <revised count="01">2003-12-28</revised>
  <bug>36142</bug>
  <access>unknown</access>
  <affected>
    <package name="dev-util/cvs" auto="yes" arch="*">
      <unaffected range="ge">1.11.11</unaffected>
      <vulnerable range="le">1.11.10</vulnerable>
    </package>
  </affected>
  <background>
    <p>
    CVS, which stands for Concurrent Versions System, is a client/server
    application which tracks changes to sets of files.  It allows multiple users
    to work concurrently on files, and then merge their changes back into the
    main tree (which can be on a remote system).  It also allows branching, or
    maintaining separate versions for files.
    </p>
  </background>
  <description>
    <p>
    Quote from ccvs.cvshome.org/servlets/NewsItemView?newsID=88:
    "Stable CVS 1.11.11 has been released. Stable releases contain only bug
    fixes from previous versions of CVS. This release adds code to the CVS
    server to prevent it from continuing as root after a user login, as an extra
    failsafe against a compromise of the CVSROOT/passwd file. Previously, any
    user with the ability to write the CVSROOT/passwd file could execute
    arbitrary code as the root user on systems with CVS pserver access enabled.
    We recommend this upgrade for all CVS servers!"
    </p>
  </description>
  <impact type="high">
    <p>
    A remote user could execute arbitrary code with the permissions of the root
    user.
    </p>
  </impact>
  <workaround>
    <p>
    There is no known workaround at this time.
    </p>
  </workaround>
  <resolution>
    <p>
    All Gentoo Linux machines with cvs installed should be updated to use
    cvs-1.11.11 or higher.
    </p>
    <code>
    # emerge sync
    # emerge -pv '&gt;=dev-util/cvs-1.11.11'
    # emerge '&gt;=dev-util/cvs-1.11.11'
    # emerge clean</code>
  </resolution>
  <references/>
</glsa>