Skip to Content.
Sympa Menu

sm-security - [SM-Security] cvs: several vulnerabilities

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Thomas HOUSSIN <thomas.houssin AT gmail.com>
  • To: sm-security <sm-security AT lists.ibiblio.org>
  • Subject: [SM-Security] cvs: several vulnerabilities
  • Date: Wed, 14 Sep 2005 11:29:09 +0200

Synopsis
========
Several vulnerabilities were fixed in cvs, both in the server and in cvsbug.

Background
==========
CVS is a Concurrent Versioning System: CVS is a version control
system, which allows you to keep old versions of files (usually source
code), keep a log of who, when, and why changes occurred, etc., like
RCS or SCCS.

Description
===========
CAN-2005-2693:
cvsbug in CVS 1.12.12 and earlier creates temporary files insecurely,
which allows local users to overwrite arbitrary files and execute
arbitrary code via a symlink attack.

CAN-2005-0753:
Buffer overflow in CVS allows remote attackers to execute arbitrary code.

Issue 224:
The confirmed vulnerability could allow the execution of arbitrary
code on the CVS server, but only if a user already had commit access
and if one of the contrib scripts was installed improperly, a
condition which should have been quickly visible to any administrator.
The complete description of the problem is here:
https://ccvs.cvshome.org/issues/show_bug.cgi?id=224.

Workaround
==========
There are no known workarounds at this time.

Affected packages
=================
cvs in all grimoires is affected. This is now fixed in all grimoires:
devel, test, stable-rc/0.2 and stable/0.1

Resolution
==========
All cvs users should upgrade to the latest available version:
# scribe update
# cast -c cvs

References
==========
[ 1 ] Changes since 1.12.11: SERVER SECURITY FIXES
http://ftp.gnu.org/non-gnu/cvs/NEWS.1.12
[ 2 ] CAN-2005-2693
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2693
[ 3 ] CAN-2005-0753
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0753


--
Thomas Houssin

Security Team Leader Source Mage GNU/Linux (http://www.sourcemage.org)
Key fingerprint = 3CB8 3FC4 840D B272 E623 BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36



  • [SM-Security] cvs: several vulnerabilities, Thomas HOUSSIN, 09/14/2005

Archive powered by MHonArc 2.6.24.

Top of Page