ESB-2017.2097 - [Ubuntu] cvs: Execute arbitrary code/commands - Remote with user interaction 2017-08-22

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2017.2097
                             cvs vulnerability
                              22 August 2017

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           cvs
Publisher:         Ubuntu
Operating System:  Ubuntu
Impact/Access:     Execute Arbitrary Code/Commands -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2017-12836  

Reference:         ESB-2017.2011

Original Bulletin: 
   http://www.ubuntu.com/usn/usn-3399-1

- --------------------------BEGIN INCLUDED TEXT--------------------

USN-3399-1: cvs vulnerability
Ubuntu Security Notice USN-3399-1
21st August, 2017

cvs vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

Ubuntu 17.04
Ubuntu 16.04 LTS
Ubuntu 14.04 LTS
Summary

cvs could be made run programs as your login if it opened a specially crafted cvs repository.

Software description

cvs - Concurrent Versions System
Details

Hank Leininger discovered that cvs did not properly handle SSH
for remote repositories. A remote attacker could use this to
construct a cvs repository that when accessed could run arbitrary
code with the privileges of the user.

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 17.04:
cvs 2:1.12.13+real-22ubuntu0.1
Ubuntu 16.04 LTS:
cvs 2:1.12.13+real-15ubuntu0.1
Ubuntu 14.04 LTS:
cvs 2:1.12.13+real-12ubuntu0.1
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2017-12836

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWZufu4x+lLeg9Ub1AQj1Yw/9Fvfw+0ICe/ntY2ahlgaHagojOHSD+GP2
rs1DxXBJZK9YzX9IdWraiSmNprwLEie2FypIAP5mLzbh/PbO/WcKgCJp+JI0NUt7
gAJscD/mu5HzDHCdJTK6g3KIOmeyBAzhhYNfXHLiYdhDmOD3YlPE6pMBW6oAWNuc
1K66ZSLMHOlPoM6YX93Z35I0JgzujTzplnUGyJURMJSBspGDx9na5lDHsA+sXpuP
ZBEYRVbuRFfJjVAvABbnBhLK3OdI5179xWS58R7DGDCNhSMNDKmowEgrgO/VZL+I
S6KiWufjCJfFVv1U1/vihQ1fRw/HY78afsaNmB2nr2X3+P8EOTa6jZNcbtSFib1D
SL9bF7n+dUTXIAlcEsFokmkTHTnF7OOsEyz725rhXApcmroRap2Mqluqi5cWAQsX
N0ayySu2JPET6QUbgoPxVOmpIIx6K+6Js21pJ+IyA1fX0YYWbqHGMReVzr7d/u2m
c9Ipxzz6css44jWzZLHoe6K/9mUs0cXUv6CrG5lrXyRUyEae5AEUbrKsHjxjLkPC
EpoHaJCJ9c8SuEklDLmPjw8We+3Ho7TAzDlkt9q9buFBYdGfPXcuYaoU4TzgqXz6
hV7fBFmK3qG/MoB0JcskSc+eazaVpMOQIN/8TZyNoxphhWoMEJHVpnlGLW6Pc1Mx
dmIskP/9g+U=
=u+r0
-----END PGP SIGNATURE-----

« Back to bulletins