New cvsnt packages has been released for Debian GNU/Linux to fix an arbitrary code execution



[SECURITY] [DSA 2108-1] New cvsnt package fixes arbitrary code execution

- - ------------------------------------------------------------------------
Debian Security Advisory DSA-2108-1 security@debian.org
Debian -- Security Information SÃbastien Delafond
Sep 14, 2010 Debian -- Debian security FAQ
- - ------------------------------------------------------------------------

Package : cvsnt
Vulnerability : programming error
Problem type : remote
Debian-specific: no
CVE Id : CVE-2010-1326
Debian Bug : 593884

It has been discovered that in cvsnt, a multi-platform version of the
original source code versioning system CVS, an error in the
authentication code allows a malicious, unprivileged user, through the
use of a specially crafted branch name, to gain write access to any
module or directory, including CVSROOT itself. The attacker can then
execute arbitrary code as root by modifying or adding administrative
scripts in that directory.

For the stable distribution (lenny), this problem has been fixed in
version 2.5.03.2382-3.3+lenny1.

We recommend that you upgrade your cvsnt package.

Upgrade instructions
- ---------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 5.0 alias lenny
- ---------------------------------

Debian (stable)
- ----------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:


Size/MD5 checksum: 1214 753ba20f4b7c368e962eb304807241ba

Size/MD5 checksum: 124606 f55d905fa0273040e2b3cd85896fb783

Size/MD5 checksum: 6804247 c50c2d82aeb274a664d8d1cf53ccd0da

Alpha architecture (DEC Alpha):


Size/MD5 checksum: 1212408 2dbee6ffffe6801f2e3615ca7568cc59

AMD64 architecture (AMD x86_64 (AMD64)):


Size/MD5 checksum: 1131270 14e47c6454415fc3ca7d1ed19b7f8499

ARM architecture (ARM):


Size/MD5 checksum: 1103540 0ea1b86c48efeefac554fa776d6d7579

ARMEL architecture (ARM EABI):


Size/MD5 checksum: 1033786 7e67f45614b6f8e80c3fbef32fe9c218

HP Precision architecture (HP PA RISC):


Size/MD5 checksum: 1219736 96275b11153eb2744aa7d0af8d7b5484

Intel IA-32 architecture (Intel ia32):


Size/MD5 checksum: 1085060 b6149560ad1931a5a6283d7263e3f41b

Intel IA-64 architecture (Intel ia64):


Size/MD5 checksum: 1503346 e29376097899808b63cc5b84bb1fd92c

Big endian MIPS architecture (MIPS (Big Endian)):


Size/MD5 checksum: 1112122 6e21379182d6954685e411407662aca5

Little endian MIPS architecture (MIPS (Little Endian)):


Size/MD5 checksum: 1115528 d276bde92371cde5b9a237d5f42514ca

PowerPC architecture (PowerPC):


Size/MD5 checksum: 1219262 d4dacc1a62e87f4a0163047cadbcf2d9

IBM S/390 architecture (IBM S/390):


Size/MD5 checksum: 1129298 7770a4dffef3c09c6352e63cd81442d7

Sun Sparc architecture (Sun SPARC/UltraSPARC):


Size/MD5 checksum: 1090472 210e12635e2f3fe27408d7021bddb4ea


These files will probably be moved into the stable distribution on
its next update.