drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in cvs
Name: |
Mehrere Probleme in cvs
|
|
ID: |
MDKSA-2004:058 |
|
Distribution: |
Mandrake |
|
Plattformen: |
Mandrake Corporate Server 2.1, Mandrake 9.1, Mandrake 9.2, Mandrake 10.0 |
|
Datum: |
Fr, 11. Juni 2004, 13:00 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0414
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0416
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0417
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0418 |
|
Applikationen: |
CVS |
|
Originalnachricht |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
_______________________________________________________________________
Mandrakelinux Security Update Advisory _______________________________________________________________________
Package name: cvs Advisory ID: MDKSA-2004:058 Date: June 9th, 2004
Affected versions: 10.0, 9.1, 9.2, Corporate Server 2.1 ______________________________________________________________________
Problem Description:
Another vulnerability was discovered related to "Entry" lines in cvs, by the development team (CAN-2004-0414). As well, Stefan Esser and Sebastian Krahmer performed an audit on the cvs source code and discovered a number of other problems, including: A double-free condition in the server code is exploitable (CAN-2004-0416). By sending a large number of arguments to the CVS server, it is possible to cause it to allocate a huge amount of memory which does not fit into the address space, causing an error (CAN-2004-0417). It was found that the serve_notify() function would write data out of bounds (CAN-2004-0418). The provided packages update cvs to 1.11.16 and include patches to correct all of these problems. _______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0414 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0416 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0417 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0418 ______________________________________________________________________
Updated Packages: Mandrakelinux 10.0: 1a502935f4df6e42c85ff1fb1ef27d30 10.0/RPMS/cvs-1.11.16-1.1.100mdk.i586.rpm 0f095c91db34af290ceba3dc9df6aa6c 10.0/SRPMS/cvs-1.11.16-1.1.100mdk.src.rpm
Mandrakelinux 10.0/AMD64: 5460c0dcc9d535d4813f999e0ffa9f85 amd64/10.0/RPMS/cvs-1.11.16-1.1.100mdk.amd64.rpm 0f095c91db34af290ceba3dc9df6aa6c amd64/10.0/SRPMS/cvs-1.11.16-1.1.100mdk.src.rpm
Corporate Server 2.1: e46d86d0b5641c4a73ec5160acf17204 corporate/2.1/RPMS/cvs-1.11.16-1.1.C21mdk.i586.rpm bb46882dbf757203299558ce1cfde165 corporate/2.1/SRPMS/cvs-1.11.16-1.1.C21mdk.src.rpm
Corporate Server 2.1/x86_64: 8185d289207e8357abb251a1ca3f571d x86_64/corporate/2.1/RPMS/cvs-1.11.16-1.1.C21mdk.x86_64.rpm bb46882dbf757203299558ce1cfde165 x86_64/corporate/2.1/SRPMS/cvs-1.11.16-1.1.C21mdk.src.rpm
Mandrakelinux 9.1: ec87f6b23f81a443057383e7181ae61f 9.1/RPMS/cvs-1.11.16-1.1.91mdk.i586.rpm 18e7ac2121ddde681ee4bd52780a0399 9.1/SRPMS/cvs-1.11.16-1.1.91mdk.src.rpm
Mandrakelinux 9.1/PPC: f63540702537363c388fcccbe7786cd6 ppc/9.1/RPMS/cvs-1.11.16-1.1.91mdk.ppc.rpm 18e7ac2121ddde681ee4bd52780a0399 ppc/9.1/SRPMS/cvs-1.11.16-1.1.91mdk.src.rpm
Mandrakelinux 9.2: c78ec66461805bae870f32fc42a40c7c 9.2/RPMS/cvs-1.11.16-1.1.92mdk.i586.rpm 8a4973fd2577fb20bf5fcec3d5081c4d 9.2/SRPMS/cvs-1.11.16-1.1.92mdk.src.rpm
Mandrakelinux 9.2/AMD64: 43ef377093ecf7a6d9034ad60993827a amd64/9.2/RPMS/cvs-1.11.16-1.1.92mdk.amd64.rpm 8a4973fd2577fb20bf5fcec3d5081c4d amd64/9.2/SRPMS/cvs-1.11.16-1.1.92mdk.src.rpm _______________________________________________________________________
To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandrakesoft for security. You can obtain the GPG public key of the Mandrakelinux Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandrakelinux at:
http://www.mandrakesoft.com/security/advisories
If you want to report vulnerabilities, please contact
security_linux-mandrake.com
Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Linux Mandrake Security Team <security linux-mandrake.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux)
iD8DBQFAx4QmmqjQ0CJFipgRAiQEAJ4qHjWP98N82HMMGLw5DEvMwxNW9QCfUUir 2y0ZQWzPUO1XZR/LQTQTbsg= =HxL7 -----END PGP SIGNATURE-----
____________________________________________________ Want to buy your Pack or Services from MandrakeSoft? Go to http://www.mandrakestore.com Join the Club : http://www.mandrakeclub.com ____________________________________________________
|
|
|
|