|
Vulnerability Assessment & Network Security Forums |
|||||||||
If through a vulnerability assessment, a network security issue is detected for the vulnerability below, applying the appropriate security patches in a timely matter is very important. If you have detected that your system has already been compromised, following CERT's Network Security recovery document will assist with recommended steps for system recovery. Home >> Browse Vulnerability Assessment Database >> Debian Local Security Checks >> [DSA422] DSA-422-1 cvs Vulnerability Assessment Details
|
[DSA422] DSA-422-1 cvs |
||
DSA-422-1 cvs Detailed Explanation for this Vulnerability Assessment The account management of the CVS pserver (which is used to give remote access to CVS repositories) uses a CVSROOT/passwd file in each repository which contains the accounts and their authentication information as well as the name of the local unix account to use when a pserver account is used. Since CVS performed no checking on what unix account was specified anyone who could modify the CVSROOT/passwd could gain access to all local users on the CVS server, including root. This has been fixed in upstream version 1.11.11 by preventing pserver from running as root. For Debian this problem is solved in version 1.11.1p1debian-9 in two different ways: Additionally, CVS pserver had a bug in parsing module requests which could be used to create files and directories outside a repository. This has been fixed upstream in version 1.11.11 and Debian version 1.11.1p1debian-9. Finally, the umask used for &ldquo cvs init&rdquo and &ldquo cvs-makerepos&rdquo has been changed to prevent repositories from being created with group write permissions. Solution : http://www.debian.org/security/2004/dsa-422 Network Security Threat Level: High Networks Security ID: Vulnerability Assessment Copyright: This script is (C) 2005 Michel Arboi |
||
Cables, Connectors |
ASUS H110M-R Motherboard Intel 6th/7th Gen LGA1151 DDR4 Micro-ATX i/o shield
$42.00
***NEW*** BCM RX67Q Gaming Motherboard | Intel Q67 2nd/3rd Gen. | LGA1155 | DDR3
$29.77
Micro ATX Desktop Motherboard ASUS H110M-C LGA 1151
$31.95
MSI B450 TOMAHAWK MAX, AMD Motherboard
$69.00
Asus H81M-C Intel LGA1150 DDR3 Desktop Motherboard MicroATX Socket H3
$24.99
Gigabyte AMD B550 UD AC Gaming Motherboard - AMD B550 Chipset - AM4 Socket - AMD
$89.99
ASUS Prime Z390-A LGA 1151 Intel Z390 SATA USB 3.1 ATX Motherboard NO I/O
$99.00
MSI B450M PRO-VDH MAX AM4 AMD B450 USB3.2 Micro-ATX Motherboard
$67.99
BTC-S37 Mining Motherboard Kit /w SSD & Ram Preinstalled
$59.99
***NEW*** BCM RX67Q mATX Gaming Motherboard Combo | Intel i5-3470 | 16GB DDR3
$49.77
|
||
No Discussions have been posted on this vulnerability. |