-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
- - ------------------------------------------------------------------------ Debian Security Advisory DSA-2108-1 security@debian.org http://www.debian.org/security/ Sébastien Delafond Sep 14, 2010 http://www.debian.org/security/faq - - ------------------------------------------------------------------------
Package : cvsnt Vulnerability : programming error Problem type : remote Debian-specific: no CVE Id : CVE-2010-1326 Debian Bug : 593884
It has been discovered that in cvsnt, a multi-platform version of the original source code versioning system CVS, an error in the authentication code allows a malicious, unprivileged user, through the use of a specially crafted branch name, to gain write access to any module or directory, including CVSROOT itself. The attacker can then execute arbitrary code as root by modifying or adding administrative scripts in that directory.
For the stable distribution (lenny), this problem has been fixed in version 2.5.03.2382-3.3+lenny1.
We recommend that you upgrade your cvsnt package.
Upgrade instructions - ---------------------
wget url will fetch the file for you dpkg -i file.deb will install the referenced file.
If you are using the apt-get package manager, use the line for sources.list as given below:
apt-get update will update the internal database apt-get upgrade will install corrected packages
You may use an automated update by adding the resources from the footer to the proper configuration.
Debian GNU/Linux 5.0 alias lenny - ---------------------------------
Debian (stable) - ----------------
Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
Source archives:
cvsnt_2.5.03.2382-3.3+lenny1.dsc Size/MD5 checksum: 1214 753ba20f4b7c368e962eb304807241ba cvsnt_2.5.03.2382-3.3+lenny1.diff.gz Size/MD5 checksum: 124606 f55d905fa0273040e2b3cd85896fb783 cvsnt_2.5.03.2382.orig.tar.gz Size/MD5 checksum: 6804247 c50c2d82aeb274a664d8d1cf53ccd0da
Alpha architecture (DEC Alpha):
cvsnt_2.5.03.2382-3.3+lenny1_alpha.deb Size/MD5 checksum: 1212408 2dbee6ffffe6801f2e3615ca7568cc59
AMD64 architecture (AMD x86_64 (AMD64)):
cvsnt_2.5.03.2382-3.3+lenny1_amd64.deb Size/MD5 checksum: 1131270 14e47c6454415fc3ca7d1ed19b7f8499
ARM architecture (ARM):
cvsnt_2.5.03.2382-3.3+lenny1_arm.deb Size/MD5 checksum: 1103540 0ea1b86c48efeefac554fa776d6d7579
ARMEL architecture (ARM EABI):
cvsnt_2.5.03.2382-3.3+lenny1_armel.deb Size/MD5 checksum: 1033786 7e67f45614b6f8e80c3fbef32fe9c218
HP Precision architecture (HP PA RISC):
cvsnt_2.5.03.2382-3.3+lenny1_hppa.deb Size/MD5 checksum: 1219736 96275b11153eb2744aa7d0af8d7b5484
Intel IA-32 architecture (Intel ia32):
cvsnt_2.5.03.2382-3.3+lenny1_i386.deb Size/MD5 checksum: 1085060 b6149560ad1931a5a6283d7263e3f41b
Intel IA-64 architecture (Intel ia64):
cvsnt_2.5.03.2382-3.3+lenny1_ia64.deb Size/MD5 checksum: 1503346 e29376097899808b63cc5b84bb1fd92c
Big endian MIPS architecture (MIPS (Big Endian)):
cvsnt_2.5.03.2382-3.3+lenny1_mips.deb Size/MD5 checksum: 1112122 6e21379182d6954685e411407662aca5
Little endian MIPS architecture (MIPS (Little Endian)):
cvsnt_2.5.03.2382-3.3+lenny1_mipsel.deb Size/MD5 checksum: 1115528 d276bde92371cde5b9a237d5f42514ca
PowerPC architecture (PowerPC):
cvsnt_2.5.03.2382-3.3+lenny1_powerpc.deb Size/MD5 checksum: 1219262 d4dacc1a62e87f4a0163047cadbcf2d9
IBM S/390 architecture (IBM S/390):
cvsnt_2.5.03.2382-3.3+lenny1_s390.deb Size/MD5 checksum: 1129298 7770a4dffef3c09c6352e63cd81442d7
Sun Sparc architecture (Sun SPARC/UltraSPARC):
cvsnt_2.5.03.2382-3.3+lenny1_sparc.deb Size/MD5 checksum: 1090472 210e12635e2f3fe27408d7021bddb4ea
These files will probably be moved into the stable distribution on its next update.
- --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-securitydists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux)
iEYEARECAAYFAkyPGmUACgkQiZgNKcDdyD9FlACfSob9ge0GUdhCMycq4aW/cWlI CiQAn257FDE+HCWQuIzpPXtlmhGEU39O =poEI -----END PGP SIGNATURE-----
-- To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org Archive: http://lists.debian.org/20100914064705.GF11984@frisco.mine.nu
|