|
|
Family: Red Hat Local Security Checks --> Category: infos
RHSA-2003-013: cvs Vulnerability Scan
Vulnerability Scan Summary
Check for the version of the cvs packages
Detailed Explanation for this Vulnerability Test
Updated CVS packages are now available for Red Hat Linux Advanced Server.
These updates fix a vulnerability which would permit arbitrary command
execution on servers configured to allow anonymous read-only access.
[Updated 06 Feb 2003]
Added fixed packages for Advanced Workstation 2.1
CVS is a version control system frequently used to manage source code
repositories. During an audit of the CVS sources, Stefan Esser discovered
an exploitable double-free bug in the CVS server.
On servers which are configured to allow anonymous read-only access, this
bug could be used by anonymous users to gain write rights. Users with
CVS write rights can then use the Update-prog and Checkin-prog features
to execute arbitrary commands on the server.
All users of CVS are advised to upgrade to these packages which
contain patches to correct the double-free bug.
Our thanks go to Stefan Esser of e-matters for reporting this issue to us.
Solution : http://rhn.redhat.com/errata/RHSA-2003-013.html
Threat Level: High
Click HERE for more information and discussions on this network vulnerability scan.
|
