SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   CVS Vendors:   GNU [multiple authors]
(Debian Issues Fix) CVS Input Validation Flaw May Let Remote Users Send Malformed Module Requests to Create Root Directories and Files
SecurityTracker Alert ID:  1008686
SecurityTracker URL:  http://securitytracker.com/id/1008686
CVE Reference:   CVE-2003-0977   (Links to External Site)
Updated:  Jan 15 2004
Original Entry Date:  Jan 13 2004
Impact:   Modification of system information, Modification of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to 1.11.10
Description:   A vulnerability was reported in CVS. A remote user may be able to cause CVS to create files and directories in the root directory.

It is reported that a remote user can submit a specially crafted and malformed module request that may cause the CVS server to attempt to create directories and possibly files at the root of the filesystem where the CVS repository is located. The report indicates that the permissions of the underlying filesystem will usually prevent the creation of these "misplaced directories."

The vendor reports that there are no known exploits for this flaw.

Impact:   A remote user may be able to cause CVS to create directories and potentially files in the filesystem root directory.
Solution:   Debian has released a fix for Debian 3.0 (stable):

Stable was released for alpha, arm, hppa, i386, ia64, m68k, mips, mipsel,
powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian.orig.tar.gz
Size/MD5 checksum: 2621658 500965ab9702b31605f8c58aa21a6205
http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9.diff.gz
Size/MD5 checksum: 49416 74746359d1b7a9cd0459ddeaa6ec52a7
http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9.dsc
Size/MD5 checksum: 681 c4089836fe7f6b777920dd37d09e982d

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_alpha.deb
Size/MD5 checksum: 1178446 3cf372c97a66e10408a1993c700e6455

arm architecture (ARM)

http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_arm.deb
Size/MD5 checksum: 1104912 99a2b7f564e27a90cb6ac38db7a9fa18

hppa architecture (HP PA RISC)

http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_hppa.deb
Size/MD5 checksum: 1147010 b63a001a84b329e9d34881d7f5489538

i386 architecture (Intel ia32)

http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_i386.deb
Size/MD5 checksum: 1085664 6d7f9f5a8730595d9ad88560b7474816

ia64 architecture (Intel ia64)

http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_ia64.deb
Size/MD5 checksum: 1270560 d7b54232097970cb7bdbded45509c45b

m68k architecture (Motorola Mc680x0)

http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_m68k.deb
Size/MD5 checksum: 1065192 ba851f9e52e3e2997c4539f326447fcc

mips architecture (MIPS (Big Endian))

http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_mips.deb
Size/MD5 checksum: 1129342 129daa41b09beab02ec928d29804f013

mipsel architecture (MIPS (Little Endian))

http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_mipsel.deb
Size/MD5 checksum: 1130598 17e765475f74a5915506b469f5ddd136

powerpc architecture (PowerPC)

http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_powerpc.deb
Size/MD5 checksum: 1115824 1c16543513c2dd1ca7e76390b8203f86

s390 architecture (IBM S/390)

http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_s390.deb
Size/MD5 checksum: 1096674 91003d24a1db0be271fe41296a76390c

sparc architecture (Sun SPARC/UltraSPARC)

http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_sparc.deb
Size/MD5 checksum: 1106822 e93a0f77253cadcfcce494f828f6fd2f

Vendor URL:  ccvs.cvshome.org/servlets/NewsItemView?newsID=84&JServSessionIdservlets=8u3x1myav1 (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Debian)
Underlying OS Comments:  3.0

Message History:   This archive entry is a follow-up to the message listed below.
Dec 9 2003 CVS Input Validation Flaw May Let Remote Users Send Malformed Module Requests to Create Root Directories and Files



 Source Message Contents

Subject:  [SECURITY] [DSA-422-1] multiple CVS improvements


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-422-1                   security@debian.org
http://www.debian.org/security/                         Wichert Akkerman
January 13, 2004
- ------------------------------------------------------------------------


Package        : cvs
Vulnerability  : multiple problems
Problem type   : remote
Debian-specific: no
CVE Id(s)      : CAN-2003-0977

The account management of the CVS pserver (which is used to give remote
access to CVS repositories) uses a CVSROOT/passwd file in each
repository which contains the accounts and their authentication
information as well as the name of the local unix account to use when a
pserver account is used. Since CVS performed no checking on what unix
account was specified anyone who could modify the CVSROOT/passwd could
gain access to all local users on the CVS server, including root.

This has been fixed in upstream version 1.11.11 by preventing pserver
from running as root. For Debian this problem is solved in version
1.11.1p1debian-9 in two different ways:

* pserver is no longer allowed to use root to access repositories

* a new /etc/cvs-repouid is introduced which can be used by the system
  administrator to override the unix account used to access a
  repository. More information on this change can be found at
  http://www.wiggy.net/code/cvs-repouid/

Additionaly, CVS pserver had a bug in parsing module requests which
could be used to create files and directories outside a repository.
This has been fixed upstream in version 1.11.11 and Debian version
1.11.1p1debian-9 .

Finally, the umask used for 'cvs init' and 'cvs-makerepos' has been
changed to prevent repositories from being created with group write
permissions.


Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian 3.0 (stable)
- -------------------

  Stable was released for alpha, arm, hppa, i386, ia64, m68k, mips, mipsel,
  powerpc, s390 and sparc.

  Source archives:

    http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian.orig.tar.gz
      Size/MD5 checksum:  2621658 500965ab9702b31605f8c58aa21a6205
    http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9.diff.gz
      Size/MD5 checksum:    49416 74746359d1b7a9cd0459ddeaa6ec52a7
    http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9.dsc
      Size/MD5 checksum:      681 c4089836fe7f6b777920dd37d09e982d

  alpha architecture (DEC Alpha)

    http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_alpha.deb
      Size/MD5 checksum:  1178446 3cf372c97a66e10408a1993c700e6455

  arm architecture (ARM)

    http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_arm.deb
      Size/MD5 checksum:  1104912 99a2b7f564e27a90cb6ac38db7a9fa18

  hppa architecture (HP PA RISC)

    http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_hppa.deb
      Size/MD5 checksum:  1147010 b63a001a84b329e9d34881d7f5489538

  i386 architecture (Intel ia32)

    http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_i386.deb
      Size/MD5 checksum:  1085664 6d7f9f5a8730595d9ad88560b7474816

  ia64 architecture (Intel ia64)

    http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_ia64.deb
      Size/MD5 checksum:  1270560 d7b54232097970cb7bdbded45509c45b

  m68k architecture (Motorola Mc680x0)

    http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_m68k.deb
      Size/MD5 checksum:  1065192 ba851f9e52e3e2997c4539f326447fcc

  mips architecture (MIPS (Big Endian))

    http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_mips.deb
      Size/MD5 checksum:  1129342 129daa41b09beab02ec928d29804f013

  mipsel architecture (MIPS (Little Endian))

    http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_mipsel.deb
      Size/MD5 checksum:  1130598 17e765475f74a5915506b469f5ddd136

  powerpc architecture (PowerPC)

    http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_powerpc.deb
      Size/MD5 checksum:  1115824 1c16543513c2dd1ca7e76390b8203f86

  s390 architecture (IBM S/390)

    http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_s390.deb
      Size/MD5 checksum:  1096674 91003d24a1db0be271fe41296a76390c

  sparc architecture (Sun SPARC/UltraSPARC)

    http://security.debian.org/pool/updates/main/c/cvs/cvs_1.11.1p1debian-9_sparc.deb
      Size/MD5 checksum:  1106822 e93a0f77253cadcfcce494f828f6fd2f

- -- 
- ----------------------------------------------------------------------------
Debian Security team <team@security.debian.org>
http://www.debian.org/security/
Mailing-List: debian-security-announce@lists.debian.org

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQFAA/3JPLiSUC+jvC0RArcyAKCE+iThueHrjGXgC5d/ggEm0oc65wCfRPIM
7PQb6G2yHPQWT+o6R4pCasg=
=J9BC
-----END PGP SIGNATURE-----


-- 
To UNSUBSCRIBE, email to debian-security-announce-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC