GLSA 200312-04: CVS: malformed module request vulnerability

http://security.gentoo.org/

Severity:	translation missing: en, label_glsa_minimal
Title:	CVS: malformed module request vulnerability
Date:	12/08/2003
Bugs:	#35371
ID:	200312-04

Synopsis

A bug in cvs could allow attempts to create files and directories outside a repository.

Background

CVS, which stands for Concurrent Versions System, is a client/server application which tracks changes to sets of files. It allows multiple users to work concurrently on files, and then merge their changes back into the main tree (which can be on a remote system). It also allows branching, or maintaining separate versions for files.

Affected packages

Package	Vulnerable	Unaffected	Architecture(s)
dev-util/cvs	<= 1.11.9	>= 1.11.10	All supported architectures

Description

Quote from ccvs.cvshome.org/servlets/NewsItemView?newsID=84: "Stable CVS 1.11.10 has been released. Stable releases contain only bug fixes from previous versions of CVS. This release fixes a security issue with no known exploits that could cause previous versions of CVS to attempt to create files and directories in the filesystem root. This release also fixes several issues relevant to case insensitive filesystems and some other bugs. We recommend this upgrade for all CVS clients and servers!"

Impact

Attempts to create files and directories outside the repository may be possible.

Workaround

There is no known workaround at this time.

Resolution

All Gentoo Linux machines with cvs installed should be updated to use dev-util/cvs-1.11.10 or higher:

    # emerge sync
    # emerge -pv '>=dev-util/cvs-1.11.10'
    # emerge '>=dev-util/cvs-1.11.10'
    # emerge clean

References

CAN-2003-0977

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200312-04.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.