-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-04:10.cvs Security Advisory The FreeBSD Project Topic: CVS pserver protocol parser errors Category: contrib Module: contrib_cvs Announced: 2004-05-19 Revised: 2004-05-20 Credits: Stefan Esser Affects: All FreeBSD versions Corrected: 2004-05-20 13:17:16 UTC (RELENG_4, 4.10-PRERELEASE) 2004-05-20 13:17:42 UTC (RELENG_4_10, 4.10-RC) 2004-05-20 13:18:08 UTC (RELENG_4_9, 4.9-RELEASE-p8) 2004-05-20 13:18:07 UTC (RELENG_4_8, 4.8-RELEASE-p21) 2004-05-20 13:18:06 UTC (RELENG_4_7, 4.7-RELEASE-p27) 2004-05-20 13:18:10 UTC (RELENG_5_2, 5.2.1-RELEASE-p7) 2004-05-20 13:18:09 UTC (RELENG_5_1, 5.1-RELEASE-p17) 2004-05-20 13:18:09 UTC (RELENG_5_0, 5.0-RELEASE-p21) CVE Name: CAN-2004-0396 FreeBSD only: NO For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . 0. Revision History v1.0 2004-05-19 Initial release. v1.1 2004-05-19 Adjusted correction dates and reference URL. v1.2 2004-05-20 Updated patch to work around bugs in some CVS clients. v1.3 2004-06-05 Corrected the workaround section. I. Background The Concurrent Versions System (CVS) is a version control system. It may be used to access a repository locally, or to access a `remote repository' using a number of different methods. When accessing a remote repository, the target machine runs the CVS server to fulfill client requests. II. Problem Description Due to a programming error in code used to parse data received from the client, malformed data can cause a heap buffer to overflow, allowing the client to overwrite arbitrary portions of the server's memory. III. Impact A malicious CVS client may run arbitrary code on the server at the privilege level of the CVS server software. IV. Workaround Administrators of CVS repositories should disable anonymous remote access. V. Solution Perform one of the following: 1) Upgrade your vulnerable system to 4-STABLE; or to the RELENG_5_2, RELENG_4_9, or RELENG_4_8 security branch dated after the correction date. 2) To patch your present system: The following patches have been verified to apply to FreeBSD 4.7, 4.8, 4.9, 4.10, 5.0, 5.1, and 5.2 systems. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:10/cvs.patch # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:10/cvs.patch.asc b) Execute the following commands as root: # cd /usr/src # patch < /path/to/patch # cd /usr/src/gnu/usr.bin/cvs # make obj && make depend && make && make install VI. Correction details The following list contains the revision numbers of each file that was corrected in FreeBSD. Branch Revision Path - ------------------------------------------------------------------------- RELENG_4 src/contrib/cvs/src/server.c 1.13.2.7 RELENG_4_10 src/contrib/cvs/src/server.c 1.13.2.5.6.2 RELENG_4_9 src/UPDATING 1.73.2.89.2.9 src/sys/conf/newvers.sh 1.44.2.32.2.9 src/contrib/cvs/src/server.c 1.13.2.5.4.2 RELENG_4_8 src/UPDATING 1.73.2.80.2.24 src/sys/conf/newvers.sh 1.44.2.29.2.22 src/contrib/cvs/src/server.c 1.13.2.5.2.2 RELENG_4_7 src/UPDATING 1.73.2.74.2.31 src/sys/conf/newvers.sh 1.44.2.26.2.29 src/contrib/cvs/src/server.c 1.13.2.2.6.3 RELENG_5_2 src/UPDATING 1.282.2.15 src/sys/conf/newvers.sh 1.56.2.14 src/contrib/cvs/src/server.c 1.19.4.3 RELENG_5_1 src/UPDATING 1.251.2.19 src/sys/conf/newvers.sh 1.50.2.19 src/contrib/cvs/src/server.c 1.19.2.2 RELENG_5_0 src/UPDATING 1.229.2.27 src/sys/conf/newvers.sh 1.48.2.22 src/contrib/cvs/src/server.c 1.17.2.3 - ------------------------------------------------------------------------- VII. References http://ccvs.cvshome.org/servlets/NewsItemView?newsID=107 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (FreeBSD) iD8DBQFAwfk9FdaIBMps37IRAhNIAJ4twfnzkcUWj+NfaEO7QBl4/J5tmgCggrvR HPugjWZJCBGmSguSQj9X8PY= =BWOO -----END PGP SIGNATURE-----