CVS: possible root compromise when using CVS pserver

1. Gentoo Linux Security Advisory

Advisory Reference	GLSA 200312-08 / cvs
Release Date	December 28, 2003
Latest Revision	December 28, 2003: 01
Impact	high
Exploitable	unknown

Package	Vulnerable versions	Unaffected versions	Architecture(s)
dev-util/cvs	<= 1.11.10	>= 1.11.11	All supported architectures

Related bugreports: #36142

Synopsis

A possible root compromise exists for CVS pservers.

2. Impact Information

Background

CVS, which stands for Concurrent Versions System, is a client/server application which tracks changes to sets of files. It allows multiple users to work concurrently on files, and then merge their changes back into the main tree (which can be on a remote system). It also allows branching, or maintaining separate versions for files.

Description

Quote from ccvs.cvshome.org/servlets/NewsItemView?newsID=88: "Stable CVS 1.11.11 has been released. Stable releases contain only bug fixes from previous versions of CVS. This release adds code to the CVS server to prevent it from continuing as root after a user login, as an extra failsafe against a compromise of the CVSROOT/passwd file. Previously, any user with the ability to write the CVSROOT/passwd file could execute arbitrary code as the root user on systems with CVS pserver access enabled. We recommend this upgrade for all CVS servers!"

Impact

A remote user could execute arbitrary code with the permissions of the root user.

3. Resolution Information

Workaround

There is no known workaround at this time.

Resolution

All Gentoo Linux machines with cvs installed should be updated to use cvs-1.11.11 or higher.

Code Listing 3.1: Resolution

# emerge sync
# emerge -pv '>=dev-util/cvs-1.11.11'
# emerge '>=dev-util/cvs-1.11.11'
# emerge clean

Page updated December 28, 2003

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.