Gentoo Linux Security Advisory GLSA 200406-06
Severity: High
Title: CVS: additional DoS and arbitrary code execution
vulnerabilities
Date: June 10, 2004
Bugs: #53408
ID: 200406-06
Synopsis
Several serious new vulnerabilities have been found in CVS,
which may allow an attacker to remotely compromise a CVS
server.
Background
CVS (Concurrent Versions System) is an open-source
network-transparent version control system. It contains both a
client utility and a server.
Affected packages
| Package | Vulnerable | Unaffected |
| 1 dev-util/cvs | <= 1.11.16-r1 | >= 1.11.17 |
Description
A team audit of the CVS source code performed by Stefan Esser
and Sebastian Krahmer resulted in the discovery of several remotely
exploitable vulnerabilities including:
- no-null-termination of “Entry” lines
- error_prog_name “double-free()”
- Argument integer overflow
- serve_notify() out of bounds writes
Impact
An attacker could use these vulnerabilities to cause a Denial of
Service or execute arbitrary code with the permissions of the user
running cvs.
Workaround
There is no known workaround at this time. All users are advised
to upgrade to the latest available version of CVS.
Resolution
All CVS users should upgrade to the latest stable version:
# emerge sync
# emerge -pv ">=dev-util/cvs-1.11.17"
# emerge ">=dev-util/cvs-1.11.17"
References
[ 1 ] E-matters Advisory 09/2004
http://security.e-matters.de/advisories/092004.html
[ 2 ] CAN-2004-0414
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0414
[ 3 ] CAN-2004-0416
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0416
[ 4 ] CAN-2004-0417
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0417
[ 5 ] CAN-2004-0418
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0418
Availability
This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200406-06.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.
License
Copyright 2004 Gentoo Technologies, Inc; referenced text belongs
to its owner(s).
The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/1.0
Gentoo Linux Security Advisory GLSA 200406-05
Severity: High
Title: Apache: Buffer overflow in mod_ssl
Date: June 09, 2004
Bugs: #51368
ID: 200406-05
Synopsis
A bug in mod_ssl may allow a remote attacker to execute remote
code when Apache is configured a certain way.
Background
Apache is the most popular Web server on the Internet. mod_ssl
provides Secure Sockets Layer encryption and authentication to
Apache 1.3. Apache 2 contains the functionality of mod_ssl.
Affected packages
| Package | Vulnerable | Unaffected |
| 1 net-www/mod_ssl | < 2.8.18 | >= 2.8.18 |
| 2 net-www/apache | <= 2.0.49-r2 | < 2.0 >= 2.0.49-r3 |
2 affected packages on all of their supported architectures.
Description
A bug in the function ssl_utiluuencodebinary in ssl_util.c may lead to a remote
buffer overflow on a server configured to use FakeBasicAuth that
will trust a client certificate with an issuing CA with a subject
DN longer than 6k.
Impact
Given the right server configuration, an attacker could cause a
Denial of Service or execute code as the user running Apache,
usually “apache”. It is thought to be impossible to exploit this to
execute code on the x86 platform, but the possibility for other
platforms is unknown. This does not preclude a DoS on x86
systems.
Workaround
A server should not be vulnerable if it is not configured to use
FakeBasicAuth and to trust a client CA with a long subject DN.
Resolution
Apache 1.x users should upgrade to the latest version of
mod_ssl:
# emerge sync
# emerge -pv ">=net-www/modssl-2.8.18
# emerge ">=net-www/modssl-2.8.18
Apache 2.x users should upgrade to the latest version of
Apache:
# emerge sync
# emerge -pv ">=net-www/apache-2.0.49-r3"
# emerge ">=net-www/apache-2.0.49-r3"
References
[ 1 ] CAN-2004-0488
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0488
Availability
This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200406-05.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.
License
Copyright 2004 Gentoo Technologies, Inc; referenced text belongs
to its owner(s).
The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.