LBA-Linux Security Advisory
Subject: Updated cvs package for LBA-Linux R1
Advisory ID: LBASA-2004:13
Date: Thursday, May 20, 2004
Product: LBA-Linux R1
Problem description:
Stefan Esser discovered a remote vulnerability in Concurrent
Versions System (CVS) servers. CVS up to version 1.12.7 contains a
flaw when deciding if a CVS entry line should get a modified or
unchanged flag attached. This results in a heap overflow which can
be exploited to execute arbitrary code on the CVS server. This
could allow a repository compromise. The Common Vulnerabilities and
Exposures (CVE) project assigned the id CAN-2004-0396 to the
problem.
Updated packages:
LBA-Linux R1:
i386:
ftp://ftp.sot.com/lba-linux_r1/apt/RPMS.updates/cvs-1.11.11-2.lba.3.i386.rpm
Upgrading your system:
To apply this security update to your LBA-Linux system, run the
Updater tool from the LBA-Linux root desktop:
- Log in to your LBA-Linux desktop as the root user.
- Click on the penguin icon at the lower left of the display, and
select the menu item SYSTEM TOOLS>UPDATER. - Click on the item named cvs to highlight it.
- Click on the PACKAGE menu in the menu bar, and select the
UPGRADE action. - Confirm the upgrade by clicking the APPLY button in Updater’s
main toolbar.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0396
http://security.e-matters.de/advisories/072004.html
Copyright(c) 2001-2004 SOT