Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 433
Alerts This Week
Warning Icon 1 433

Gentoo: 200312-08 High: CVS Root Privilege Escalation Fix

gentoo
Calendar Grey December 29, 2003
Dist Gentoo Esm H88
Debian releases urgent update for Git to address privilege escalation threats within user login mechanisms.
This release adds code to the CVS server to prevent it from continuing as root after a user login, as an extra failsafe against a compromise of the CVSROOT/passwd file.

Summary


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200312-08
- --------------------------------------------------------------------------

GLSA:        200312-08
package:     dev-util/cvs
summary:     Fix for possible root compromise when using CVS pserver
severity:    high
Gentoo bug:  36142
date:        2003-12-28
exploit:     unknown
affected:    <=1.11.10 fixed:>=1.11.11


DESCRIPTION:

Quote from  <;:

   "Stable CVS 1.11.11 has been released. Stable releases contain only
   bug fixes from previous versions of CVS. This release adds code to
   the CVS server to prevent it from continuing as root after a user
   login, as an extra failsafe against a compromise of the
   CVSROOT/passwd file. Previously, any user with the ability to write
   the CVSROOT/passwd file could execute arbitrary code as the root
   user on systems with CVS pserver access enabled. We recommend ...
Read the Full Advisory
Topics%20covered

Topics Covered

security advisory Gentoo high severity CVS update root compromise

Resolution

References

Availability

style>.gentoo_availability{display:block;}

Concerns

Severity
critical
Lowest
Low
Medium
High
Critical

Topics%20covered

Topics Covered

security advisory Gentoo high severity CVS update root compromise

Synopsis

Background

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

Impact

Workaround