[ Thanks to SOT Linux
Security Team for this link. ]
---------------------------------------------------------------------
SOT Linux Security Advisory
Subject: Updated cvs package for SOT Linux 2002
Advisory ID: SLSA-2003:6
Date: Saturday, January 25, 2003
Product: SOT Linux 2002
---------------------------------------------------------------------
1. Problem description
Double-free vulnerabiity in CVS 1.11.4 and earlier allows
remote attackers to cause a denial of service and possibly
execute arbitrary code via a malformed Directory request,
as demonstrated by bypassing write checks to execute
Update-prog and Checkin-prog commands.
Users of cvs are advised to update cvs package.
2. Updated packages
SOT Linux 2002 Desktop:
i386:
ftp://ftp.sot.com/updates/2002/Desktop/i386/cvs-1.11.1p1-2.i386.rpm
SRPMS:
ftp://ftp.sot.com/updates/2002/Desktop/SRPMS/cvs-1.11.1p1-2.src.rpm
SOT Linux 2002 Server:
i386:
ftp://ftp.sot.com/updates/2002/Server/i386/cvs-1.11.1p1-2.i386.rpm
SRPMS:
ftp://ftp.sot.com/updates/2002/Server/SRPMS/cvs-1.11.1p1-2.src.rpm
3. Upgrading package
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
If you want to upgrade, download the updated package from
the SOT Linux FTP site (use the links above) or from one of our mirrors.
The list of mirrors can be obtained at www.sot.com/en/linux
Update the package with the following command:
rpm -Uvh
4. Verification
All packages are PGP signed by SOT for security.
You can verify each package with the following command:
rpm --checksig
If you wish to verify the integrity of the downloaded package, run
"md5sum " and compare the output with data given below.
Package Name MD5 sum
---------------------------------------------------------------------
/Desktop/i386/cvs-1.11.1p1-2.i386.rpm 5d7290d89201372fd8a7c81dcf152166
/Desktop/SRPMS/cvs-1.11.1p1-2.src.rpm 0d54dbdb762f01e7e9003d8a4eaa9654
/Server/i386/cvs-1.11.1p1-2.i386.rpm 5d7290d89201372fd8a7c81dcf152166
/Server/SRPMS/cvs-1.11.1p1-2.src.rpm 0d54dbdb762f01e7e9003d8a4eaa9654
5. References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0015
http://security.e-matters.de/advisories/012003.html
Copyright(c) 2001, 2002 SOT