From rajiv@gentoo.org Mon Dec 29 15:49:28 2003 From: Rajiv Aaron Manglani X-Sender: (Unverified) To: bugtraq@securityfocus.com Date: Mon, 29 Dec 2003 02:21:15 -0500 Subject: GLSA: cvs (200312-08) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- GENTOO LINUX SECURITY ANNOUNCEMENT 200312-08 - -------------------------------------------------------------------------- GLSA: 200312-08 package: dev-util/cvs summary: Fix for possible root compromise when using CVS pserver severity: high Gentoo bug: 36142 date: 2003-12-28 exploit: unknown affected: <=1.11.10 fixed: >=1.11.11 DESCRIPTION: Quote from : "Stable CVS 1.11.11 has been released. Stable releases contain only bug fixes from previous versions of CVS. This release adds code to the CVS server to prevent it from continuing as root after a user login, as an extra failsafe against a compromise of the CVSROOT/passwd file. Previously, any user with the ability to write the CVSROOT/passwd file could execute arbitrary code as the root user on systems with CVS pserver access enabled. We recommend this upgrade for all CVS servers!" SOLUTION: All Gentoo Linux machines with cvs installed should be updated to use cvs-1.11.11 or higher. emerge sync emerge -pv '>=dev-util/cvs-1.11.11' emerge '>=dev-util/cvs-1.11.11' emerge clean // end -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (Darwin) iD8DBQE/79SAnt0v0zAqOHYRAuWTAJ9UY/lAvsKQRtHLQZr/zDUf5eok6wCgumZt ICbAjuPbALouwsdG16pqS6s= =UQlf -----END PGP SIGNATURE-----