Login
Newsletter
Werbung

Sicherheit: Überschreiben von Dateien in Subversion
Aktuelle Meldungen Distributionen
Name: Überschreiben von Dateien in Subversion
ID: MDVSA-2013:236
Distribution: Mandriva
Plattformen: Mandriva Enterprise Server 5.0, Mandriva Business Server 1.0
Datum: Di, 17. September 2013, 22:35
Referenzen: http://advisories.mageia.org/MGASA-2013-0275.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4277
Applikationen: Subversion

Originalnachricht

This is a multi-part message in MIME format...

------------=_1379429301-3002-47

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2013:236
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : subversion
Date : September 17, 2013
Affected: Business Server 1.0, Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

Updated subversion package fixes security vulnerability:

svnserve takes a --pid-file option which creates a file containing
the process id it is running as. It does not take steps to ensure that
the file it has been directed at is not a symlink. If the pid file is
in a directory writeable by unprivileged users, the destination could
be replaced by a symlink allowing for privilege escalation. svnserve
does not create a pid file by default (CVE-2013-4277).
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4277
http://advisories.mageia.org/MGASA-2013-0275.html
_______________________________________________________________________

Updated Packages:

Mandriva Enterprise Server 5:
f38b6d470f6b3abbbe3637f7db8f83bf
mes5/i586/apache-mod_dav_svn-1.7.13-0.1mdvmes5.2.i586.rpm
79eaa7f7b5729e353eb2446dc5b785c4
mes5/i586/libsvn0-1.7.13-0.1mdvmes5.2.i586.rpm
eced9a06a4b06c0043d0cc84c7134f34
mes5/i586/libsvnjavahl1-1.7.13-0.1mdvmes5.2.i586.rpm
69de835ea0d3f19122dcebd6085150cb
mes5/i586/perl-SVN-1.7.13-0.1mdvmes5.2.i586.rpm
da3fa6b9d3470c69f45f5ca095735e86
mes5/i586/perl-svn-devel-1.7.13-0.1mdvmes5.2.i586.rpm
81b5d5fccd015dab9ba5a9bd1db1984a
mes5/i586/python-svn-1.7.13-0.1mdvmes5.2.i586.rpm
5a02a46a08209eb00d171504979b40bc
mes5/i586/python-svn-devel-1.7.13-0.1mdvmes5.2.i586.rpm
bb97e89d549dcb75c342790f3e98a21e
mes5/i586/ruby-svn-1.7.13-0.1mdvmes5.2.i586.rpm
87de26a0718108205bf67d180ac741d2
mes5/i586/ruby-svn-devel-1.7.13-0.1mdvmes5.2.i586.rpm
3408dd9520cd66e93545327de0ad9d64
mes5/i586/subversion-1.7.13-0.1mdvmes5.2.i586.rpm
df5c215fe1fe39aaa4ee37f704f6e99a
mes5/i586/subversion-devel-1.7.13-0.1mdvmes5.2.i586.rpm
865cb136fe8b7a60605d428c6a4334be
mes5/i586/subversion-doc-1.7.13-0.1mdvmes5.2.i586.rpm
8a7f8f4c55c03782cc8bb3321dad0c47
mes5/i586/subversion-server-1.7.13-0.1mdvmes5.2.i586.rpm
3d6705b4423dd9f6873a04937ede3161
mes5/i586/subversion-tools-1.7.13-0.1mdvmes5.2.i586.rpm
963001ca144f80537d04527a12c2d104
mes5/i586/svn-javahl-1.7.13-0.1mdvmes5.2.i586.rpm
72de43be089762d25b7a138e5c846418
mes5/SRPMS/subversion-1.7.13-0.1mdvmes5.2.src.rpm

Mandriva Enterprise Server 5/X86_64:
cdd4e6d6349dd17625790619f60c8f07
mes5/x86_64/apache-mod_dav_svn-1.7.13-0.1mdvmes5.2.x86_64.rpm
32fcd137383abb3e68295b810318d30b
mes5/x86_64/lib64svn0-1.7.13-0.1mdvmes5.2.x86_64.rpm
3d8e646dce5faf522efa72b5a29b55f2
mes5/x86_64/lib64svnjavahl1-1.7.13-0.1mdvmes5.2.x86_64.rpm
93e83a6648bd5b2c27ac199a0d2a08ed
mes5/x86_64/perl-SVN-1.7.13-0.1mdvmes5.2.x86_64.rpm
844f66677639a071c1e1165fec0d81ef
mes5/x86_64/perl-svn-devel-1.7.13-0.1mdvmes5.2.x86_64.rpm
d30cbade30979a3757b724a6c9ae133a
mes5/x86_64/python-svn-1.7.13-0.1mdvmes5.2.x86_64.rpm
52a63621e29da829f54b8d3210b9e18c
mes5/x86_64/python-svn-devel-1.7.13-0.1mdvmes5.2.x86_64.rpm
e7c15654ccd49e57eb1f8d4358d028d5
mes5/x86_64/ruby-svn-1.7.13-0.1mdvmes5.2.x86_64.rpm
539a73b3f80f78ddbebaed77a3ae2497
mes5/x86_64/ruby-svn-devel-1.7.13-0.1mdvmes5.2.x86_64.rpm
2e8e764515e3dbf65a411db72fab1660
mes5/x86_64/subversion-1.7.13-0.1mdvmes5.2.x86_64.rpm
1e713f5ff21e66afe04f712b11caca84
mes5/x86_64/subversion-devel-1.7.13-0.1mdvmes5.2.x86_64.rpm
7f32b4e7d8db8c3b73cbb4663613cb6f
mes5/x86_64/subversion-doc-1.7.13-0.1mdvmes5.2.x86_64.rpm
f5bbfe6823d11b2d69e76b2f4b8d6962
mes5/x86_64/subversion-server-1.7.13-0.1mdvmes5.2.x86_64.rpm
e6f00db7ff88ee9332124e62674da98f
mes5/x86_64/subversion-tools-1.7.13-0.1mdvmes5.2.x86_64.rpm
968551d0705e89cc00a03ba94d341234
mes5/x86_64/svn-javahl-1.7.13-0.1mdvmes5.2.x86_64.rpm
72de43be089762d25b7a138e5c846418
mes5/SRPMS/subversion-1.7.13-0.1mdvmes5.2.src.rpm

Mandriva Business Server 1/X86_64:
15a554623be239cef5c1f8b32d9fec0f
mbs1/x86_64/apache-mod_dav_svn-1.7.13-0.1.mbs1.x86_64.rpm
a0c7531ddfa472cae631ef7d843b45f4
mbs1/x86_64/lib64svn0-1.7.13-0.1.mbs1.x86_64.rpm
2d7df851596596eb6307120c4f938d1f
mbs1/x86_64/lib64svn-gnome-keyring0-1.7.13-0.1.mbs1.x86_64.rpm
caa80719005033a251fa612458881e0d
mbs1/x86_64/lib64svnjavahl1-1.7.13-0.1.mbs1.x86_64.rpm
5722904c8dc97b9f9599f18b06788a3a
mbs1/x86_64/perl-SVN-1.7.13-0.1.mbs1.x86_64.rpm
2cd8fe8824eb66f0cd923755e5cde1d8
mbs1/x86_64/perl-svn-devel-1.7.13-0.1.mbs1.x86_64.rpm
fc2cd3e7aa5a1c6ff6839024ce21cc04
mbs1/x86_64/python-svn-1.7.13-0.1.mbs1.x86_64.rpm
a6e4c1d28d11f68ef28b00cce7c30923
mbs1/x86_64/python-svn-devel-1.7.13-0.1.mbs1.x86_64.rpm
29cf7fdd3e87513bd9d7de09819d6af1
mbs1/x86_64/ruby-svn-1.7.13-0.1.mbs1.x86_64.rpm
f271e5772649d7ae2d38e7a56b085547
mbs1/x86_64/ruby-svn-devel-1.7.13-0.1.mbs1.x86_64.rpm
dc62ebf26014691939c4ee2f2ecf2682
mbs1/x86_64/subversion-1.7.13-0.1.mbs1.x86_64.rpm
ece2561d082b91449c6115b7c803e053
mbs1/x86_64/subversion-devel-1.7.13-0.1.mbs1.x86_64.rpm
23836d4e6fd10ae59fbfa741883da2ff
mbs1/x86_64/subversion-doc-1.7.13-0.1.mbs1.x86_64.rpm
bc2d6f0be3d16aff9d0a49f8b279ebe8
mbs1/x86_64/subversion-gnome-keyring-devel-1.7.13-0.1.mbs1.x86_64.rpm
e3b8c167b97bced9ecea20280917cc2e
mbs1/x86_64/subversion-server-1.7.13-0.1.mbs1.x86_64.rpm
54d71a7936c1304f7227689a55cf7504
mbs1/x86_64/subversion-tools-1.7.13-0.1.mbs1.x86_64.rpm
0d5d041b96c18384951885829c9f8484
mbs1/x86_64/svn-javahl-1.7.13-0.1.mbs1.x86_64.rpm
8f29b3d96f1be7f22be000d1f6629a4a
mbs1/SRPMS/subversion-1.7.13-0.1.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFSOD76mqjQ0CJFipgRArF5AKCW4HD+MaGMPZcHu1LHNKGlRV1yDQCgiosL
1MsidUuX3l0EvAtvynFSnjA=
=oNo5
-----END PGP SIGNATURE-----


------------=_1379429301-3002-47
Content-Type: text/plain; charset="UTF-8";
name="message-footer.txt"
Content-Disposition: inline; filename="message-footer.txt"
Content-Transfer-Encoding: 8bit

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
_______________________________________________________


------------=_1379429301-3002-47--
Pro-Linux
Traut euch!
Neue Nachrichten
Werbung