Articles / Debian: New cvsnt package f…

Debian: New cvsnt package fixes arbitrary code execution

It has been discovered that in cvsnt, a multi-platform version of the original source code versioning system CVS, an error in the authentication code allows a malicious, unprivileged user, through the use of a specially crafted branch name, to gain write access to any module or directory, including CVSROOT itself. The attacker can then execute arbitrary code as root by modifying or adding administrative scripts in that directory. Updated packages are available from security.debian.org.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - ------------------------------------------------------------------------
Debian Security Advisory DSA-2108-1                  security@debian.org
http://www.debian.org/security/                       Sébastien Delafond
Sep 14, 2010                          http://www.debian.org/security/faq
- - ------------------------------------------------------------------------

Package        : cvsnt
Vulnerability  : programming error
Problem type   : remote
Debian-specific: no
CVE Id         : CVE-2010-1326
Debian Bug     : 593884

It has been discovered that in cvsnt, a multi-platform version of the
original source code versioning system CVS, an error in the
authentication code allows a malicious, unprivileged user, through the
use of a specially crafted branch name, to gain write access to any
module or directory, including CVSROOT itself. The attacker can then
execute arbitrary code as root by modifying or adding administrative
scripts in that directory.

For the stable distribution (lenny), this problem has been fixed in
version 2.5.03.2382-3.3+lenny1.

We recommend that you upgrade your cvsnt package.

Upgrade instructions
- ---------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 5.0 alias lenny
- ---------------------------------

Debian (stable)
- ----------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

 http://security.debian.org/pool/updates/main/c/cvsnt/cvsnt_2.5.03.2382-3.3+lenny1.dsc
   Size/MD5 checksum:     1214 753ba20f4b7c368e962eb304807241ba
 http://security.debian.org/pool/updates/main/c/cvsnt/cvsnt_2.5.03.2382-3.3+lenny1.diff.gz
   Size/MD5 checksum:   124606 f55d905fa0273040e2b3cd85896fb783
 http://security.debian.org/pool/updates/main/c/cvsnt/cvsnt_2.5.03.2382.orig.tar.gz
   Size/MD5 checksum:  6804247 c50c2d82aeb274a664d8d1cf53ccd0da

Alpha architecture (DEC Alpha):

 http://security.debian.org/pool/updates/main/c/cvsnt/cvsnt_2.5.03.2382-3.3+lenny1_alpha.deb
   Size/MD5 checksum:  1212408 2dbee6ffffe6801f2e3615ca7568cc59

AMD64 architecture (AMD x86_64 (AMD64)):

 http://security.debian.org/pool/updates/main/c/cvsnt/cvsnt_2.5.03.2382-3.3+lenny1_amd64.deb
   Size/MD5 checksum:  1131270 14e47c6454415fc3ca7d1ed19b7f8499

ARM architecture (ARM):

 http://security.debian.org/pool/updates/main/c/cvsnt/cvsnt_2.5.03.2382-3.3+lenny1_arm.deb
   Size/MD5 checksum:  1103540 0ea1b86c48efeefac554fa776d6d7579

ARMEL architecture (ARM EABI):

 http://security.debian.org/pool/updates/main/c/cvsnt/cvsnt_2.5.03.2382-3.3+lenny1_armel.deb
   Size/MD5 checksum:  1033786 7e67f45614b6f8e80c3fbef32fe9c218

HP Precision architecture (HP PA RISC):

 http://security.debian.org/pool/updates/main/c/cvsnt/cvsnt_2.5.03.2382-3.3+lenny1_hppa.deb
   Size/MD5 checksum:  1219736 96275b11153eb2744aa7d0af8d7b5484

Intel IA-32 architecture (Intel ia32):

 http://security.debian.org/pool/updates/main/c/cvsnt/cvsnt_2.5.03.2382-3.3+lenny1_i386.deb
   Size/MD5 checksum:  1085060 b6149560ad1931a5a6283d7263e3f41b

Intel IA-64 architecture (Intel ia64):

 http://security.debian.org/pool/updates/main/c/cvsnt/cvsnt_2.5.03.2382-3.3+lenny1_ia64.deb
   Size/MD5 checksum:  1503346 e29376097899808b63cc5b84bb1fd92c

Big endian MIPS architecture (MIPS (Big Endian)):

 http://security.debian.org/pool/updates/main/c/cvsnt/cvsnt_2.5.03.2382-3.3+lenny1_mips.deb
   Size/MD5 checksum:  1112122 6e21379182d6954685e411407662aca5

Little endian MIPS architecture (MIPS (Little Endian)):

 http://security.debian.org/pool/updates/main/c/cvsnt/cvsnt_2.5.03.2382-3.3+lenny1_mipsel.deb
   Size/MD5 checksum:  1115528 d276bde92371cde5b9a237d5f42514ca

PowerPC architecture (PowerPC):

 http://security.debian.org/pool/updates/main/c/cvsnt/cvsnt_2.5.03.2382-3.3+lenny1_powerpc.deb
   Size/MD5 checksum:  1219262 d4dacc1a62e87f4a0163047cadbcf2d9

IBM S/390 architecture (IBM S/390):

 http://security.debian.org/pool/updates/main/c/cvsnt/cvsnt_2.5.03.2382-3.3+lenny1_s390.deb
   Size/MD5 checksum:  1129298 7770a4dffef3c09c6352e63cd81442d7

Sun Sparc architecture (Sun SPARC/UltraSPARC):

 http://security.debian.org/pool/updates/main/c/cvsnt/cvsnt_2.5.03.2382-3.3+lenny1_sparc.deb
   Size/MD5 checksum:  1090472 210e12635e2f3fe27408d7021bddb4ea


 These files will probably be moved into the stable distribution on
 its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkyPGmUACgkQiZgNKcDdyD9FlACfSob9ge0GUdhCMycq4aW/cWlI
CiQAn257FDE+HCWQuIzpPXtlmhGEU39O
=poEI
-----END PGP SIGNATURE——
Screenshot

Project Spotlight

Kigo Video Converter Ultimate for Mac

A tool for converting and editing videos.

Screenshot

Project Spotlight

Kid3

An efficient tagger for MP3, Ogg/Vorbis, and FLAC files.