3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
110 lines
4 KiB
Text
110 lines
4 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA1
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-03:01.cvs Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: remotely exploitable vulnerability in cvs server
|
|
|
|
Category: contrib
|
|
Module: contrib_cvs
|
|
Announced: 2003-02-04
|
|
Credits: Stefan Esser <s.esser@e-matters.de>
|
|
Affects: All FreeBSD versions prior to 4.6-RELEASE-p7, 4.7-RELEASE-p4,
|
|
5.0-RELEASE-p1
|
|
Corrected: 2003-01-21 22:26:46 UTC (RELENG_4)
|
|
2003-02-04 18:05:07 UTC (RELENG_5_0)
|
|
2003-02-04 18:07:20 UTC (RELENG_4_7)
|
|
2003-02-04 18:08:26 UTC (RELENG_4_6)
|
|
FreeBSD only: NO
|
|
|
|
I. Background
|
|
|
|
The Concurrent Versions System (CVS) is a version control system. It
|
|
may be used to access a repository locally, or to access a `remote
|
|
repository' using several different methods, including `ext' (rsh),
|
|
and `pserver' (password-authenticated server). When accessing a
|
|
remote repository, the target machine runs the CVS server to fulfill
|
|
client requests.
|
|
|
|
II. Problem Description
|
|
|
|
The implementation of the CVS server contains a programming error which
|
|
can lead to a block of memory being freed more than once (i.e. a
|
|
double-free bug).
|
|
|
|
Separately, the CVS server allows clients with write access to specify
|
|
arbitrary commands to execute as part of an update (update-prog) or
|
|
commit (checkin-prog). This is a dangerous feature that is generally
|
|
not needed: there are other, safer methods of triggering program
|
|
execution.
|
|
|
|
III. Impact
|
|
|
|
An attacker may exploit the double-free bug in order to bypass write
|
|
access checks. Combined with the update-prog/checkin-prog feature,
|
|
the attacker may be able to execute arbitrary commands with the
|
|
privileges of the CVS server. The impact is most severe when running
|
|
the CVS server in `pserver' mode to provide read-only access to the
|
|
world (anoncvs).
|
|
|
|
IV. Workaround
|
|
|
|
Do not use `pserver' mode directly. Instead, use one of the safer
|
|
methods described in the following online resources:
|
|
|
|
<URL:http://openbsd.sunsite.ualberta.ca/papers/anoncvs-paper.ps>
|
|
<URL:http://www.netsys.com/library/papers/chrooted-ssh-cvs-server.txt>
|
|
|
|
V. Solution
|
|
|
|
1) Upgrade your vulnerable system to 4.7-STABLE; or to the RELENG_4_7
|
|
(4.7-RELEASE-p4), RELENG_4_6 (4.6-RELEASE-p7), or RELENG_5_0
|
|
(5.0-RELEASE-p1) security branch dated after the correction date.
|
|
|
|
2) To patch your present system:
|
|
|
|
The following patch has been verified to apply to FreeBSD 4.6, 4.7, and
|
|
5.0 systems.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-03:01/cvs.patch
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-03:01/cvs.patch.asc
|
|
|
|
b) Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
# cd /usr/src/gnu/usr.bin/cvs
|
|
# make obj && make depend && make && make install
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the revision numbers of each file that was
|
|
corrected in FreeBSD.
|
|
|
|
Path Revision
|
|
Branch
|
|
- -------------------------------------------------------------------------
|
|
src/contrib/cvs/src/server.c
|
|
RELENG_5_0 1.17.2.1
|
|
RELENG_4_7 1.13.2.2.6.1
|
|
RELENG_4_6 1.13.2.2.4.1
|
|
- -------------------------------------------------------------------------
|
|
|
|
VII. References
|
|
|
|
<URL:http://online.securityfocus.com/archive/1/72584>
|
|
<URL:http://security.e-matters.de/advisories/012003.html>
|
|
<URL:http://ccvs.cvshome.org/servlets/NewsItemView?newsID=51>
|
|
<URL:http://www.kb.cert.org/vuls/id/650937>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v1.2.1 (FreeBSD)
|
|
|
|
iD8DBQE+QAU9FdaIBMps37IRAvYzAKCeaZ1eWwiWNxRqgNRwnn4TwuwPPACdGF8T
|
|
0Ym2kCQxU0sJSRxmgAA/yM4=
|
|
=9+5m
|
|
-----END PGP SIGNATURE-----
|