security advisoryinformation leakremote access
Hajvan Sehic discovered several vulnerabilities in viewcvs, a utility for viewing CVS and Subversion repositories via HTTP. When exporting a repository as a tar archive the hide_cvsroot and forbidden settings were not honoured enough.. --------------------------------------------------------------------------Debian Security Advisory DSA 605-1 This email address is being protected from spambots. You need JavaScript enabled to view it. http://www.debian.org/security/ Martin Schulze December 6th, 2004 http://www.debian.org/security/faq --------------------------------------------------------------------------Package : viewcvs Vulnerability : settings not honored Problem-Type : remote Debian-specific: no CVE ID : CAN-2004-0915 Hajvan Sehic discovered several vulnerabilities in viewcvs, a utility for viewing CVS and Subversion repositories via HTTP. When exporting a repository as a tar archive the hide_cvsroot and forbidden settings were not honoured enough. When upgrading the package for woody, please make a copy of your /etc/viewcvs/viewcvs.conf file if you have manually edited this file. Upon upgrade the debconf mechanism may alter it in a way so that viewcvs doesn't understand it anymore. For the stable distribution (woody) these problems have been fixed in version 0.9.2-4woody1. For the unstable distribution (sid) these problems have been fixed in version 0.9.2+cvs.1.0.dev.2004.07.28-1.2. We recommend that you upgrade your viewcvs package. Upgrade Instructions --------------------wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.0 aliaswoody -------------------------------- Source archives: Size/MD5 checksum: 628 4d0b925c801e55393ddb9d32e04699bd Size/MD5 checksum: 33345 34be8bcc7e47f26b8e85ff48a38be023 Size/MD5 checksum: 140063 c7857b1ed05240ad1f691ea40044daf2 Architecture independent components: Size/MD5 checksum: 216628 a83bff813d3146d126dd5d6059c5ef0e These files will probably be moved into the stable distribution on its next update. ---------------------------------------------------------------------------------For apt-get: deb https://www.debian.org/security/ stable/updates main For dpkg-ftp: dists/stable/updates/main Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. Package info: `apt-cache show ' and https://www.debian.org/distrib/packages . --------------------------------------------------------------------------Debian Security Advisory D. hajvan, sehic, vulnerabilities, viewcvs, utility, viewing, subversion. . LinuxSecurity.com Team
Dec 06, 2004
Debian
Refine advisories
