SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   CVS Vendors:   Caldera/SCO
(Caldera Issues Fix for OpenLinux) Concurrent Versions System (CVS) Off-by-one Buffer Overflow May Let Local Users Execute Arbitrary Code to Gain Elevated Privileges
SecurityTracker Alert ID:  1005004
SecurityTracker URL:  http://securitytracker.com/id/1005004
CVE Reference:   CVE-2002-0844   (Links to External Site)
Updated:  Jan 14 2004
Original Entry Date:  Aug 9 2002
Impact:   Execution of arbitrary code via local system, User access via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 1.11
Description:   A buffer overflow vulnerability has been reported in the Concurrent Versions System (CVS) daemon. A local user may be able to execute arbitrary code with the privileges of the CVS process.

The flaw reportedly resides in the 'cvs-1.11/src/rcs.c' file, where a sscanf() call is made specifying that 16 bytes should be read from the 'info->data' variable into a 15 byte (plus NULL) variable 'devtype[16]'. The 'info->data' variable is apparently based on the contents of a symlinked file on the local system. A local user could create a special value for the contents of this file to trigger the CVS buffer overflow and execute arbitrary code.

Impact:   A local user could cause the CVS server to execute arbitrary code with the privileges of the CVS daemon.
Solution:   Caldera has released a fix for OpenLinux.

OpenLinux 3.1.1 Server:

Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-035.0/RPMS

Packages

446921ba85f2f865d698060ab344d189 cvs-1.11-8.i386.rpm
11ddbffdbf9310b24364b2b91d851acc cvs-doc-ps-1.11-8.i386.rpm

Installation

rpm -Fvh cvs-1.11-8.i386.rpm
rpm -Fvh cvs-doc-ps-1.11-8.i386.rpm

Source Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-035.0/SRPMS

Source Packages

0e5b474050456ed691d77fc8ce5825be cvs-1.11-8.src.rpm


OpenLinux 3.1.1 Workstation:

Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2002-035.0/RPMS

Packages

d24451d87b1c7424f12bb41d4873c3df cvs-1.11-8.i386.rpm
035d93df5ab69f025f7d08a583977658 cvs-doc-ps-1.11-8.i386.rpm

Installation

rpm -Fvh cvs-1.11-8.i386.rpm
rpm -Fvh cvs-doc-ps-1.11-8.i386.rpm

Source Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2002-035.0/SRPMS

Source Packages

ba797e325ccc15beff8506f27ee4436e cvs-1.11-8.src.rpm


OpenLinux 3.1 Server:

Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-035.0/RPMS

Packages

1f3a09e4fcc1a8a0d011a6e7fcd0d810 cvs-1.11-8.i386.rpm
ff3e5b2acdd60e4b0492b212603a0d23 cvs-doc-ps-1.11-8.i386.rpm

Installation

rpm -Fvh cvs-1.11-8.i386.rpm
rpm -Fvh cvs-doc-ps-1.11-8.i386.rpm

Source Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-035.0/SRPMS

Source Packages

c54cf8725ca2d24535e3abe86524fcb8 cvs-1.11-8.src.rpm


OpenLinux 3.1 Workstation:

Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2002-035.0/RPMS

Packages

cf5125e9586da6217df51051f66eb8d6 cvs-1.11-8.i386.rpm
4bce0b96a28195c75878515b6a37777d cvs-doc-ps-1.11-8.i386.rpm

Installation

rpm -Fvh cvs-1.11-8.i386.rpm
rpm -Fvh cvs-doc-ps-1.11-8.i386.rpm

Source Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2002-035.0/SRPMS

Source Packages

05f22c4bfcb98b826fcbb85e1d81f637 cvs-1.11-8.src.rpm

Vendor URL:  www.caldera.com/support/security/index.html (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Caldera/SCO)
Underlying OS Comments:  OpenLinux 3.1, 3.1.1; Workstation and Server

Message History:   This archive entry is a follow-up to the message listed below.
May 25 2002 Concurrent Versions System (CVS) Off-by-one Buffer Overflow May Let Local Users Execute Arbitrary Code to Gain Elevated Privileges



 Source Message Contents

Subject:  Security Update: [CSSA-2002-035.0] Linux: local off by one in cvsd


--7qSK/uQB79J36Y4o
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: 8bit            

To: bugtraq@securityfocus.com announce@lists.caldera.com security-alerts@linuxsecurity.com full-disclosure@lists.netsys.com

______________________________________________________________________________

		Caldera International, Inc.  Security Advisory

Subject:		Linux: local off by one in cvsd 
Advisory number: 	CSSA-2002-035.0
Issue date: 		2002 August 08
Cross reference:
______________________________________________________________________________


1. Problem Description

	There is a locally exploitable vulnerability in the cvsd program.


2. Vulnerable Supported Versions

	System				Package
	----------------------------------------------------------------------

	OpenLinux 3.1.1 Server		prior to cvs-1.11-8.i386.rpm
					prior to cvs-doc-ps-1.11-8.i386.rpm

	OpenLinux 3.1.1 Workstation	prior to cvs-1.11-8.i386.rpm
					prior to cvs-doc-ps-1.11-8.i386.rpm

	OpenLinux 3.1 Server		prior to cvs-1.11-8.i386.rpm
					prior to cvs-doc-ps-1.11-8.i386.rpm

	OpenLinux 3.1 Workstation	prior to cvs-1.11-8.i386.rpm
					prior to cvs-doc-ps-1.11-8.i386.rpm


3. Solution

	The proper solution is to install the latest packages. Many
	customers find it easier to use the Caldera System Updater, called
	cupdate (or kcupdate under the KDE environment), to update these
	packages rather than downloading and installing them by hand.


4. OpenLinux 3.1.1 Server

	4.1 Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-035.0/RPMS

	4.2 Packages

	446921ba85f2f865d698060ab344d189	cvs-1.11-8.i386.rpm
	11ddbffdbf9310b24364b2b91d851acc	cvs-doc-ps-1.11-8.i386.rpm

	4.3 Installation

	rpm -Fvh cvs-1.11-8.i386.rpm
	rpm -Fvh cvs-doc-ps-1.11-8.i386.rpm

	4.4 Source Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-035.0/SRPMS

	4.5 Source Packages

	0e5b474050456ed691d77fc8ce5825be	cvs-1.11-8.src.rpm


5. OpenLinux 3.1.1 Workstation

	5.1 Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2002-035.0/RPMS

	5.2 Packages

	d24451d87b1c7424f12bb41d4873c3df	cvs-1.11-8.i386.rpm
	035d93df5ab69f025f7d08a583977658	cvs-doc-ps-1.11-8.i386.rpm

	5.3 Installation

	rpm -Fvh cvs-1.11-8.i386.rpm
	rpm -Fvh cvs-doc-ps-1.11-8.i386.rpm

	5.4 Source Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2002-035.0/SRPMS

	5.5 Source Packages

	ba797e325ccc15beff8506f27ee4436e	cvs-1.11-8.src.rpm


6. OpenLinux 3.1 Server

	6.1 Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-035.0/RPMS

	6.2 Packages

	1f3a09e4fcc1a8a0d011a6e7fcd0d810	cvs-1.11-8.i386.rpm
	ff3e5b2acdd60e4b0492b212603a0d23	cvs-doc-ps-1.11-8.i386.rpm

	6.3 Installation

	rpm -Fvh cvs-1.11-8.i386.rpm
	rpm -Fvh cvs-doc-ps-1.11-8.i386.rpm

	6.4 Source Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-035.0/SRPMS

	6.5 Source Packages

	c54cf8725ca2d24535e3abe86524fcb8	cvs-1.11-8.src.rpm


7. OpenLinux 3.1 Workstation

	7.1 Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2002-035.0/RPMS

	7.2 Packages

	cf5125e9586da6217df51051f66eb8d6	cvs-1.11-8.i386.rpm
	4bce0b96a28195c75878515b6a37777d	cvs-doc-ps-1.11-8.i386.rpm

	7.3 Installation

	rpm -Fvh cvs-1.11-8.i386.rpm
	rpm -Fvh cvs-doc-ps-1.11-8.i386.rpm

	7.4 Source Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2002-035.0/SRPMS

	7.5 Source Packages

	05f22c4bfcb98b826fcbb85e1d81f637	cvs-1.11-8.src.rpm


8. References

	Specific references for this advisory:
		http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0081.html

	Caldera security resources:
		http://www.caldera.com/support/security/index.html

	This security fix closes Caldera incidents sr865452, fz521139,
	erg712068.


9. Disclaimer

	Caldera International, Inc. is not responsible for the misuse
	of any of the information we provide on this website and/or
	through our security advisories. Our advisories are a service
	to our customers intended to promote secure installation and
	use of Caldera products.


10. Acknowledgements

	David Reign (davidreign@hotmail.com) discovered and reported
	this vulnerability. Larry Jones (the maintainer) provided more
	information, and a fix for the issue.

______________________________________________________________________________

--7qSK/uQB79J36Y4o
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (SCO_SV)
Comment: For info see http://www.gnupg.org

iEYEARECAAYFAj1TBk0ACgkQbluZssSXDTHGzQCcCq2xaesvsGphHooOLMqKNSgz
/LkAmQECxJyL7h1kohEkd3k+X12JRl+a
=Sdol
-----END PGP SIGNATURE-----

--7qSK/uQB79J36Y4o--

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC