RHSA-2003:013 - Security Advisory
cvs security update
Security Advisory: Critical
Updated CVS packages are now available for Red Hat Linux Advanced Server.
These updates fix a vulnerability which would permit arbitrary command
execution on servers configured to allow anonymous read-only access.
[Updated 06 Feb 2003]
Added fixed packages for Advanced Workstation 2.1
CVS is a version control system frequently used to manage source code
repositories. During an audit of the CVS sources, Stefan Esser discovered
an exploitable double-free bug in the CVS server.
On servers which are configured to allow anonymous read-only access, this
bug could be used by anonymous users to gain write privileges. Users with
CVS write privileges can then use the Update-prog and Checkin-prog features
to execute arbitrary commands on the server.
All users of CVS are advised to upgrade to these packages which
contain patches to correct the double-free bug.
Our thanks go to Stefan Esser of e-matters for reporting this issue to us.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:
This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.
- Red Hat Enterprise Linux Server 2 ia64
- Red Hat Enterprise Linux Workstation 2 ia64
- BZ - 82014 - cvs remote security issue
Red Hat Enterprise Linux Server 2
Red Hat Enterprise Linux Workstation 2