dcsimg
Linux Today: Linux News On Internet Time.




More on LinuxToday


SOT Linux Advisory: cvs

Jan 26, 2003, 01:25 (0 Talkback[s])

[ Thanks to SOT Linux Security Team for this link. ]

---------------------------------------------------------------------
                   SOT Linux Security Advisory

Subject:           Updated cvs package for SOT Linux 2002
Advisory ID:       SLSA-2003:6
Date:              Saturday, January 25, 2003
Product:           SOT Linux 2002
---------------------------------------------------------------------

1. Problem description

Double-free vulnerabiity in CVS 1.11.4 and earlier allows
remote attackers to cause a denial of service and possibly
execute arbitrary code via a malformed Directory request,
as demonstrated by bypassing write checks to execute
Update-prog and Checkin-prog commands.
Users of cvs are advised to update cvs package.


2. Updated packages

SOT Linux 2002 Desktop:

i386:
ftp://ftp.sot.com/updates/2002/Desktop/i386/cvs-1.11.1p1-2.i386.rpm

SRPMS:
ftp://ftp.sot.com/updates/2002/Desktop/SRPMS/cvs-1.11.1p1-2.src.rpm

SOT Linux 2002 Server:

i386:
ftp://ftp.sot.com/updates/2002/Server/i386/cvs-1.11.1p1-2.i386.rpm

SRPMS:
ftp://ftp.sot.com/updates/2002/Server/SRPMS/cvs-1.11.1p1-2.src.rpm
3. Upgrading package

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

If you want to upgrade, download the updated package from
the SOT Linux FTP site (use the links above) or from one of our mirrors.
The list of mirrors can be obtained at www.sot.com/en/linux

Update the package with the following command:
rpm -Uvh 


4. Verification

All packages are PGP signed by SOT for security.

You can verify each package with the following command:
rpm --checksig 

If you wish to verify the integrity of the downloaded package, run
\"md5sum \" and compare the output with data given below.

Package Name                         MD5 sum
---------------------------------------------------------------------
/Desktop/i386/cvs-1.11.1p1-2.i386.rpm  5d7290d89201372fd8a7c81dcf152166
/Desktop/SRPMS/cvs-1.11.1p1-2.src.rpm  0d54dbdb762f01e7e9003d8a4eaa9654
/Server/i386/cvs-1.11.1p1-2.i386.rpm   5d7290d89201372fd8a7c81dcf152166
/Server/SRPMS/cvs-1.11.1p1-2.src.rpm   0d54dbdb762f01e7e9003d8a4eaa9654


5. References

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0015
http://security.e-matters.de/advisories/012003.html

Copyright(c) 2001, 2002 SOT