U radu programskog paketa cvs uočen je sigurnosni nedostatak kojeg udaljeni napadač može iskoristiti za izvođenje napada uskraćivanjem usluge (DoS napad), a moguće je i izvršavanje proizvoljnog programskog koda.
Paket:
cvs 1.x
Operacijski sustavi:
Mandriva Linux 2010.1, Mandriva Linux 2011, Mandriva Linux Enterprise Server 5.0
Propust je posljedica preljeva međuspremnika u CVS klijentu do kojeg dolazi zbog nepravilnog rukovanja odgovorima HTTP posrednog (eng. proxy) poslužitelja.
Posljedica:
Propust je moguće iskoristiti za rušenje CVS klijenta ili za izvođenje proizvoljnog programskog koda s ovlastima korisnika koji koristi CVS klijent.
Rješenje:
Svim korisnicima se savjetuje korištenje programske nadogradnje koja otklanja opisani propust.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2012:044
http://www.mandriva.com/security/
_______________________________________________________________________
Package : cvs
Date : March 29, 2012
Affected: 2010.1, 2011., Enterprise Server 5.0
_______________________________________________________________________
Problem Description:
A vulnerability has been found and corrected in cvs:
A heap-based buffer overflow flaw was found in the way the CVS client
handled responses from HTTP proxies. A malicious HTTP proxy could
use this flaw to cause the CVS client to crash or, possibly, execute
arbitrary code with the privileges of the user running the CVS client
(CVE-2012-0804).
The updated packages have been patched to correct this issue.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0804
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2010.1:
75eadafea0df6324db8e1036d32f52a7
2010.1/i586/cvs-1.12.13-18.1mdv2010.2.i586.rpm
11e671d1b1ef4938a1ea857b6bde2b8b
2010.1/SRPMS/cvs-1.12.13-18.1mdv2010.2.src.rpm
Mandriva Linux 2010.1/X86_64:
d2c2e13fb83f5e9548f5fc45e4a9416a
2010.1/x86_64/cvs-1.12.13-18.1mdv2010.2.x86_64.rpm
11e671d1b1ef4938a1ea857b6bde2b8b
2010.1/SRPMS/cvs-1.12.13-18.1mdv2010.2.src.rpm
Mandriva Linux 2011:
8f0aabdd69627ba79ff8c5506e5bbbd5 2011/i586/cvs-1.12.13-18.1-mdv2011.0.i586.rpm
cd6ef457350d4f25b762efcf613e95e4 2011/SRPMS/cvs-1.12.13-18.1.src.rpm
Mandriva Linux 2011/X86_64:
36a3b6d65bbbbf80ce2b949a2c906a2e
2011/x86_64/cvs-1.12.13-18.1-mdv2011.0.x86_64.rpm
cd6ef457350d4f25b762efcf613e95e4 2011/SRPMS/cvs-1.12.13-18.1.src.rpm
Mandriva Enterprise Server 5:
a883573ca234e76fd1179634034a41e4 mes5/i586/cvs-1.12.13-18.1mdvmes5.2.i586.rpm
ac4f289b966f7af566c921b7111f186c mes5/SRPMS/cvs-1.12.13-18.1mdvmes5.2.src.rpm
Mandriva Enterprise Server 5/X86_64:
f27b646c50d6412f7d3e855d85b07abb
mes5/x86_64/cvs-1.12.13-18.1mdvmes5.2.x86_64.rpm
ac4f289b966f7af566c921b7111f186c mes5/SRPMS/cvs-1.12.13-18.1mdvmes5.2.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iD8DBQFPdBeZmqjQ0CJFipgRAgF1AKDf/v3sGgDmbj3HiUuDO5JaDJS3TgCg7UIc
LJvfJkrvUExhZxyrvXboNEg=
=AYEA
-----END PGP SIGNATURE-----
Posljednje sigurnosne preporuke