Linux Today: Linux News On Internet Time.
Search Linux Today
Linux News Sections: Developer - High Performance - Infrastructure - IT Management - Security - Storage -
Linux Today Navigation
LT Home
Contribute
Contribute
Link to Us
Linux Jobs

Partner Sites
JustLinux.com
Linux Planet
PHPBuilder
Technology Jobs

Top White Papers

Current Newswire:

More on LinuxToday

Applications Management Engineer Sr (NYC)
Next Step Systems
US-NY-New York

Justtechjobs.com Post A Job | Post A Resume

Gentoo Linux Advisory: cvs

Dec 12, 2003, 00:59 (0 Talkback[s])
GENTOO LINUX SECURITY ANNOUNCEMENT 200312-04
GLSA: 200312-04
package: dev-util/cvs
summary: Fix for malformed module request vulnerability in cvs
severity: minimal
Gentoo bug: 35371
date: 2003-12-08
CVE: CAN-2003-0977
exploit: unknown
affected: <=1.11.9
fixed: >=1.11.10

DESCRIPTION:

Quote from <http://ccvs.cvshome.org/servlets/NewsItemView?newsID=84>:

Stable CVS 1.11.10 has been released. Stable releases contain only bug fixes from previous versions of CVS. This release fixes a security issue with no known exploits that could cause previous versions of CVS to attempt to create files and directories in the filesystem root. This release also fixes several issues relevant to case insensitive filesystems and some other bugs. We recommend this upgrade for all CVS clients and servers!

SOLUTION:

All Gentoo Linux machines with cvs installed should be updated to use cvs-1.11.10 or higher.

        emerge sync
        emerge -pv '>=dev-util/cvs-1.11.10'
        emerge '>=dev-util/cvs-1.11.10'
        emerge clean

// end