Stay Secure with the Latest Linux Advisories

security advisorymoderate severityslackware

Slackware: 2003-345-01 Moderate: CVS Server Directory Issue

CVS is a client/server version control system. As a server, it is used to host source code repositories. As a client, it is used to access such repositories. This advisory deals with the use of CVS as a server. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] cvs security update (SSA:2003-345-01) CVS is a client/server version control system. As a server, it is used to host source code repositories. As a client, it is used to access such repositories. This advisory deals with the use of CVS as a server. A security problem which could allow an attacker to create directories and possibly files outside of the CVS repository has been fixed with the release of cvs-1.11.10. Any sites running a CVS server should upgrade to the new CVS package. Here are the details from the Slackware 9.1 ChangeLog: +--------------------------+ Thu Dec 11 12:29:30 PST 2003 patches/packages/cvs-1.11.10-i486-1.tgz: Upgraded to cvs-1.11.10. - From the NEWS file: SERVER SECURITY ISSUES * Malformed module requests could cause the CVS server to attempt to create directories and possibly files at the root of the filesystem holding the CVS repository. Filesystem permissions usually prevent the creation of these misplaced directories, but nevertheless, the CVS server now rejects the malformed requests. (* Security fix *) +--------------------------+ WHERE TO FIND THE NEW PACKAGE: +-----------------------------+ Updated package for Slackware 8.1: Updated package for Slackware 9.0: Updated package for Slackware 9.1: Updated package for Slackware -current: MD5 SIGNATURES: +-------------+ Slackware 8.1 package: 1aff9e868759883f160f7d75800cef63 cvs-1.11.10-i386-1.tgz Slackware 9.0 package: fa213d474908fe0cabd9d41270867eb1 cvs-1.11.10-i386-1.tgz Slackware 9.1 package: e8b66036e4338e18e8d793c1c2b3e3a3 cvs-1.11.10-i486-1.tgz Slackware -current package: 422e1586900f6bf1c363c240fc0368b1 cvs-1.11.10-i486-1.tgz INSTALLATION INSTRUCTIONS: +------------------------+ First, shut downthe cvs server if you are running one. Then, upgrade the package: # upgradepkg cvs-1.11.10-i486-1.tgz Finally, restart the CVS server. +-----+ . Tackling the CVS cybersecurity patch (SSA:2003-345-01) and crucial modifications for CVS server vulnerabilities.. CVS Update, Slackware Advisory, Source Code Security. . LinuxSecurity.com Team

Dec 11, 2003 Slackware