diff options
Diffstat (limited to 'metadata/glsa/glsa-200404-13.xml')
| -rw-r--r-- | metadata/glsa/glsa-200404-13.xml | 70 |
1 files changed, 70 insertions, 0 deletions
diff --git a/metadata/glsa/glsa-200404-13.xml b/metadata/glsa/glsa-200404-13.xml new file mode 100644 index 000000000000..ad9d0fcd2731 --- /dev/null +++ b/metadata/glsa/glsa-200404-13.xml @@ -0,0 +1,70 @@ +<?xml version="1.0" encoding="utf-8"?> +<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd"> +<glsa id="200404-13"> + <title>CVS Server and Client Vulnerabilities</title> + <synopsis> + There are two vulnerabilities in CVS; one in the server and one in the + client. These vulnerabilities allow the reading and writing of arbitrary + files on both client and server. + </synopsis> + <product type="ebuild">cvs</product> + <announced>2004-04-14</announced> + <revised count="02">2006-05-22</revised> + <bug>47800</bug> + <access>remote</access> + <affected> + <package name="dev-util/cvs" auto="yes" arch="*"> + <unaffected range="ge">1.11.15</unaffected> + <vulnerable range="le">1.11.14</vulnerable> + </package> + </affected> + <background> + <p> + CVS, which stands for Concurrent Versions System, is a client/server + application which tracks changes to sets of files. It allows multiple + users to work concurrently on files, and then merge their changes back + into the main tree (which can be on a remote system). It also allows + branching, or maintaining separate versions for files. + </p> + </background> + <description> + <p> + There are two vulnerabilities in CVS; one in the server and one in the + client. The server vulnerability allows a malicious client to request + the contents of any RCS file to which the server has permission, even + those not located under $CVSROOT. The client vulnerability allows a + malicious server to overwrite files on the client machine anywhere the + client has permissions. + </p> + </description> + <impact type="normal"> + <p> + Arbitrary files may be read or written on CVS clients and servers by + anybody with access to the CVS tree. + </p> + </impact> + <workaround> + <p> + There is no known workaround at this time. All users are encouraged to + upgrade to the latest stable version of CVS. + </p> + </workaround> + <resolution> + <p> + All CVS users should upgrade to the latest stable version. + </p> + <code> + # emerge sync + + # emerge -pv ">=dev-util/cvs-1.11.15" + # emerge ">=dev-util/cvs-1.11.15"</code> + </resolution> + <references> + <uri link="http://ccvs.cvshome.org/source/browse/ccvs/NEWS?rev=1.116.2.92&content-type=text/x-cvsweb-markup">CVS commit log</uri> + <uri link="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0180">CVE-2004-0180</uri> + <uri link="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0405">CVE-2004-0405</uri> + </references> + <metadata tag="submitter"> + condordes + </metadata> +</glsa> |