-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
             AUSCERT External Security Bulletin Redistribution

            ESB-2004.0034 -- Debian Security Advisory DSA-422-1
                         multiple CVS improvements
                              14 January 2004

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:                cvs
Publisher:              Debian
Operating System:       Debian GNU/Linux 3.0
                        Linux
Impact:                 Root Compromise
                        Create Arbitrary Files
Access Required:        Remote
CVE Names:              CAN-2003-0977

Ref:                    ESB-2004.0002

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - ------------------------------------------------------------------------
Debian Security Advisory DSA-422-1                   security@debian.org
http://www.debian.org/security/                         Wichert Akkerman
January 13, 2004
- - ------------------------------------------------------------------------


Package        : cvs
Vulnerability  : multiple problems
Problem type   : remote
Debian-specific: no
CVE Id(s)      : CAN-2003-0977

The account management of the CVS pserver (which is used to give remote
access to CVS repositories) uses a CVSROOT/passwd file in each
repository which contains the accounts and their authentication
information as well as the name of the local unix account to use when a
pserver account is used. Since CVS performed no checking on what unix
account was specified anyone who could modify the CVSROOT/passwd could
gain access to all local users on the CVS server, including root.

This has been fixed in upstream version 1.11.11 by preventing pserver
from running as root. For Debian this problem is solved in version
1.11.1p1debian-9 in two different ways:

* pserver is no longer allowed to use root to access repositories

* a new /etc/cvs-repouid is introduced which can be used by the system
  administrator to override the unix account used to access a
  repository. More information on this change can be found at
  http://www.wiggy.net/code/cvs-repouid/

Additionaly, CVS pserver had a bug in parsing module requests which
could be used to create files and directories outside a repository.
This has been fixed upstream in version 1.11.11 and Debian version
1.11.1p1debian-9 .

Finally, the umask used for 'cvs init' and 'cvs-makerepos' has been
changed to prevent repositories from being created with group write
permissions.


Upgrade instructions
- - --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian 3.0 (stable)
- - -------------------

  Stable was released for alpha, arm, hppa, i386, ia64, m68k, mips, mipsel,
  powerpc, s390 and sparc.

  Source archives:

    http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian.orig.tar.gz
      Size/MD5 checksum:  2621658 500965ab9702b31605f8c58aa21a6205
    http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9.diff.gz
      Size/MD5 checksum:    49416 74746359d1b7a9cd0459ddeaa6ec52a7
    http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9.dsc
      Size/MD5 checksum:      681 c4089836fe7f6b777920dd37d09e982d

  alpha architecture (DEC Alpha)

    http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_alpha.deb
      Size/MD5 checksum:  1178446 3cf372c97a66e10408a1993c700e6455

  arm architecture (ARM)

    http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_arm.deb
      Size/MD5 checksum:  1104912 99a2b7f564e27a90cb6ac38db7a9fa18

  hppa architecture (HP PA RISC)

    http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_hppa.deb
      Size/MD5 checksum:  1147010 b63a001a84b329e9d34881d7f5489538

  i386 architecture (Intel ia32)

    http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_i386.deb
      Size/MD5 checksum:  1085664 6d7f9f5a8730595d9ad88560b7474816

  ia64 architecture (Intel ia64)

    http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_ia64.deb
      Size/MD5 checksum:  1270560 d7b54232097970cb7bdbded45509c45b

  m68k architecture (Motorola Mc680x0)

    http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_m68k.deb
      Size/MD5 checksum:  1065192 ba851f9e52e3e2997c4539f326447fcc

  mips architecture (MIPS (Big Endian))

    http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_mips.deb
      Size/MD5 checksum:  1129342 129daa41b09beab02ec928d29804f013

  mipsel architecture (MIPS (Little Endian))

    http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_mipsel.deb
      Size/MD5 checksum:  1130598 17e765475f74a5915506b469f5ddd136

  powerpc architecture (PowerPC)

    http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_powerpc.deb
      Size/MD5 checksum:  1115824 1c16543513c2dd1ca7e76390b8203f86

  s390 architecture (IBM S/390)

    http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_s390.deb
      Size/MD5 checksum:  1096674 91003d24a1db0be271fe41296a76390c

  sparc architecture (Sun SPARC/UltraSPARC)

    http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_sparc.deb
      Size/MD5 checksum:  1106822 e93a0f77253cadcfcce494f828f6fd2f

- - -- 
- - ----------------------------------------------------------------------------
Debian Security team <team@security.debian.org>
http://www.debian.org/security/
Mailing-List: debian-security-announce@lists.debian.org

- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQFAA/3JPLiSUC+jvC0RArcyAKCE+iThueHrjGXgC5d/ggEm0oc65wCfRPIM
7PQb6G2yHPQWT+o6R4pCasg=
=J9BC
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business 
                hours which are GMT+10:00 (AEST).  On call after hours 
                for member emergencies only.
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBQATP1Ch9+71yA2DNAQGTEwP+Kh0uhT0zmH/Y1Xf26kSsgOOlmYaowyRY
a7tAViE9GDpICBcTk6JSemlEJkF4uNewAqUJoYidYJCiXHZFbuhI5Hl8a9CA3yH8
USE0D65uSSaHFP7WyRC9gbpDw3wKLmC4fbHAnp750SAg9sHLqMvmxxVgPhaRAKr2
hiXe/yQZdlY=
=dAcS
-----END PGP SIGNATURE-----