[gentoo-announce] GLSA: cvs (200312-08)

[ian!]

- --------------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200312-08
- --------------------------------------------------------------------------

GLSA: 200312-08
package: dev-util/cvs
summary: Fix for possible root compromise when using CVS pserver
severity: high
Gentoo bug: 36142
date: 2003-12-28
exploit: unknown
affected: <=1.11.10
fixed: >=1.11.11


DESCRIPTION:

Quote from <http://ccvs.cvshome.org/servlets/NewsItemView?newsID=88>:

"Stable CVS 1.11.11 has been released. Stable releases contain only
bug fixes from previous versions of CVS. This release adds code to
the CVS server to prevent it from continuing as root after a user
login, as an extra failsafe against a compromise of the
CVSROOT/passwd file. Previously, any user with the ability to write
the CVSROOT/passwd file could execute arbitrary code as the root
user on systems with CVS pserver access enabled. We recommend this upgrade for all CVS servers!"

SOLUTION:

All Gentoo Linux machines with cvs installed should be updated to use
cvs-1.11.11 or higher.

emerge sync
emerge -pv '>=dev-util/cvs-1.11.11'
emerge '>=dev-util/cvs-1.11.11'
emerge clean


// end
_________________
"To have a successful open source project, you need to be at least somewhat successful at getting along with people." -- Daniel Robbins