SOT Linux Security Advisory
Subject: Updated cvs package for SOT Linux 2003
Advisory ID: SLSA-2004:17
Date: Thursday, April 22, 2004
Product: SOT Linux 2003
1. Problem description
CVS is a version control system frequently used to manage source
code repositories.
Sebastian Krahmer discovered a flaw in CVS clients where rcs diff
files can create files with absolute pathnames. An attacker could
create a fake malicious CVS server that would cause arbitrary files
to be created or overwritten when a victim connects to it. The
Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name
CAN-2004-0180 to this issue.
Users of CVS are advised to upgrade to these erratum packages,
which contain a patch correcting this issue.
2. Updated packages
SOT Linux 2003 Server:
i386:
ftp://ftp.sot.com/updates/2003/Server/i386/cvs-1.11.10-2.i386.rpm
ftp://ftp.sot.com/updates/2003/Server/i386/cvs-krb5-1.11.10-2.i386.rpm
SRPMS:
ftp://ftp.sot.com/updates/2003/Server/SRPMS/cvs-1.11.10-2.src.rpm
3. Upgrading package
Before applying this update, make sure all previously released
errata relevant to your system have been applied. Use up2date to
automatically upgrade the fixed packages.
If you want to upgrade manually, download the updated package
from the SOT Linux FTP site (use the links above).
Update the package with the following command: rpm -Uvh
<filename>
4. Verification
All packages are PGP signed by SOT for security.
You can verify each package with the following command: rpm
–checksig <filename>
If you wish to verify the integrity of the downloaded package,
run “md5sum <filename>” and compare the output with data
given below.
Package Name MD5 sum
/Server/i386/cvs-1.11.10-2.i386.rpm
d6624114ef7599c639482ec93415a64f
/Server/i386/cvs-krb5-1.11.10-2.i386.rpm
8ad0a6d79984c1a8ddb1d15af25a837d
/Server/SRPMS/cvs-1.11.10-2.src.rpm
4232275240a5fd0d2d67ec76517135ad
5. References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0180
Copyright(c) 2001-2003 SOT