From owner-freebsd-security-notifications@FreeBSD.ORG Wed May 19 00:26:05 2004 Return-Path: Delivered-To: freebsd-security-notifications@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 0E65516A4CF; Wed, 19 May 2004 00:26:05 -0700 (PDT) Received: from smtp.des.no (flood.des.no [217.116.83.31]) by mx1.FreeBSD.org (Postfix) with ESMTP id 6456843D39; Wed, 19 May 2004 00:26:04 -0700 (PDT) (envelope-from security-advisories@freebsd.org) Received: by smtp.des.no (Pony Express, from userid 666) id E1339531B; Wed, 19 May 2004 09:25:58 +0200 (CEST) Received: from dwp.des.no (des.no [80.203.228.37]) by smtp.des.no (Pony Express) with ESMTP id 506245313; Wed, 19 May 2004 09:25:17 +0200 (CEST) Received: by dwp.des.no (Postfix, from userid 2602) id 6248433CB0; Wed, 19 May 2004 09:25:16 +0200 (CEST) From: FreeBSD Security Advisories To: FreeBSD Security Advisories Precedence: bulk Message-Id: <20040519072516.6248433CB0@dwp.des.no> Date: Wed, 19 May 2004 09:25:16 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on flood.des.no X-Spam-Level: s X-Spam-Status: No, hits=1.8 required=5.0 tests=ADDR_FREE autolearn=no version=2.63 Subject: FreeBSD Security Advisory FreeBSD-SA-04:10.cvs X-BeenThere: freebsd-security-notifications@freebsd.org X-Mailman-Version: 2.1.1 Reply-To: security-advisories@freebsd.org List-Id: Moderated Security Notifications [moderated, low volume] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 May 2004 07:26:05 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-04:10.cvs Security Advisory The FreeBSD Project Topic: CVS pserver protocol parser errors Category: contrib Module: contrib_cvs Announced: 2004-05-19 Credits: Stefan Esser Affects: All FreeBSD versions Corrected: 2004-05-18 07:21:57 UTC (RELENG_4, 4.10-PRERELEASE) 2004-05-18 07:16:53 UTC (RELENG_4_10, 4.10-RC) 2004-05-18 07:19:55 UTC (RELENG_4_9, 4.9-RELEASE-p8) 2004-05-18 07:19:55 UTC (RELENG_4_8, 4.8-RELEASE-p21) 2004-05-18 07:19:54 UTC (RELENG_4_7, 4.7-RELEASE-p27) 2004-05-18 07:19:57 UTC (RELENG_5_2, 5.2.1-RELEASE-p7) 2004-05-18 07:19:57 UTC (RELENG_5_1, 5.1-RELEASE-p17) 2004-05-18 07:19:56 UTC (RELENG_5_0, 5.0-RELEASE-p21) CVE Name: CAN-2004-0396 FreeBSD only: NO For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . I. Background The Concurrent Versions System (CVS) is a version control system. It may be used to access a repository locally, or to access a `remote repository' using a number of different methods. When accessing a remote repository, the target machine runs the CVS server to fulfill client requests. II. Problem Description Due to a programming error in code used to parse data received from the client, malformed data can cause a heap buffer to overflow, allowing the client to overwrite arbitrary portions of the server's memory. III. Impact A malicious CVS client may run arbitrary code on the server at the privilege level of the CVS server software. IV. Workaround Administrators of CVS repositories should disable remote access through the "pserver" mechanism. CVS servers which only allow remote access through the "ext" mechanism (using RSH or SSH) are not affected. V. Solution Perform one of the following: 1) Upgrade your vulnerable system to 4-STABLE; or to the RELENG_5_2, RELENG_4_9, or RELENG_4_8 security branch dated after the correction date. 2) To patch your present system: The following patches have been verified to apply to FreeBSD 4.7, 4.8, 4.9, 4.10, 5.0, 5.1, and 5.2 systems. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:10/cvs.patch # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:10/cvs.patch.asc b) Execute the following commands as root: # cd /usr/src # patch < /path/to/patch # cd /usr/src/gnu/usr.bin/cvs # make obj && make depend && make && make install VI. Correction details The following list contains the revision numbers of each file that was corrected in FreeBSD. Branch Revision Path - - ------------------------------------------------------------------------- RELENG_4 src/contrib/cvs/src/server.c 1.13.2.6 RELENG_4_10 src/contrib/cvs/src/server.c 1.13.2.5.6.1 RELENG_4_9 src/UPDATING 1.73.2.89.2.9 src/sys/conf/newvers.sh 1.44.2.32.2.9 src/contrib/cvs/src/server.c 1.13.2.5.4.1 RELENG_4_8 src/UPDATING 1.73.2.80.2.24 src/sys/conf/newvers.sh 1.44.2.29.2.22 src/contrib/cvs/src/server.c 1.13.2.5.2.1 RELENG_4_7 src/UPDATING 1.73.2.74.2.31 src/sys/conf/newvers.sh 1.44.2.26.2.29 src/contrib/cvs/src/server.c 1.13.2.2.6.2 RELENG_5_2 src/UPDATING 1.282.2.15 src/sys/conf/newvers.sh 1.56.2.14 src/contrib/cvs/src/server.c 1.19.4.2 RELENG_5_1 src/UPDATING 1.251.2.19 src/sys/conf/newvers.sh 1.50.2.19 src/contrib/cvs/src/server.c 1.19.2.1 RELENG_5_0 src/UPDATING 1.229.2.27 src/sys/conf/newvers.sh 1.48.2.22 src/contrib/cvs/src/server.c 1.17.2.2 - - ------------------------------------------------------------------------- VII. References http://ccvs.cvshome.org/servlets/NewsItemView?newsID=104 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (FreeBSD) iD8DBQFAqwkQFdaIBMps37IRArhZAJsGIEXbfY6Lsaf4Ox76A0SIBNG9swCfRSGB SPFgXGZog6YaYxDO7V4juKc= =oIAh -----END PGP SIGNATURE-----