Gentoo Logo

CVS: malformed module request vulnerability

Content:

1.  Gentoo Linux Security Advisory

Version Information

Advisory Reference GLSA 200312-04 / CVS
Release Date December 8, 2003
Latest Revision December 8, 2003: 01
Impact minimal
Exploitable unknown
Package Vulnerable versions Unaffected versions Architecture(s)
dev-util/cvs <= 1.11.9 >= 1.11.10 All supported architectures

Related bugreports: #35371

Synopsis

A bug in cvs could allow attempts to create files and directories outside a repository.

2.  Impact Information

Background

CVS, which stands for Concurrent Versions System, is a client/server application which tracks changes to sets of files. It allows multiple users to work concurrently on files, and then merge their changes back into the main tree (which can be on a remote system). It also allows branching, or maintaining separate versions for files.

Description

Quote from ccvs.cvshome.org/servlets/NewsItemView?newsID=84: "Stable CVS 1.11.10 has been released. Stable releases contain only bug fixes from previous versions of CVS. This release fixes a security issue with no known exploits that could cause previous versions of CVS to attempt to create files and directories in the filesystem root. This release also fixes several issues relevant to case insensitive filesystems and some other bugs. We recommend this upgrade for all CVS clients and servers!"

Impact

Attempts to create files and directories outside the repository may be possible.

3.  Resolution Information

Workaround

There is no known workaround at this time.

Resolution

All Gentoo Linux machines with cvs installed should be updated to use dev-util/cvs-1.11.10 or higher:

Code Listing 3.1: Resolution

# emerge sync
# emerge -pv '>=dev-util/cvs-1.11.10'
# emerge '>=dev-util/cvs-1.11.10'
# emerge clean

4.  References



Print

Page updated December 8, 2003

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.

Copyright 2001-2014 Gentoo Foundation, Inc. Questions, Comments? Contact us.