Is this cvs-rcs-offbyone-bo(9175)?
-----Original Message-----
From: security@caldera.com [mailto:security@caldera.com]
Sent: Thursday, August 08, 2002 8:01 PM
To: bugtraq@securityfocus.com; announce@lists.caldera.com;
security-alerts@linuxsecurity.com; full-disclosure@lists.netsys.com
Subject: [Full-Disclosure] Security Update: [CSSA-2002-035.0] Linux:
local off by one in cvsd
To: bugtraq@securityfocus.com announce@lists.caldera.com
security-alerts@linuxsecurity.com full-disclosure@lists.netsys.com
________________________________________________________________________
______
Caldera International, Inc. Security Advisory
Subject: Linux: local off by one in cvsd
Advisory number: CSSA-2002-035.0
Issue date: 2002 August 08
Cross reference:
________________________________________________________________________
______
1. Problem Description
There is a locally exploitable vulnerability in the cvsd
program.
2. Vulnerable Supported Versions
System Package
----------------------------------------------------------------------
OpenLinux 3.1.1 Server prior to cvs-1.11-8.i386.rpm
prior to
cvs-doc-ps-1.11-8.i386.rpm
OpenLinux 3.1.1 Workstation prior to cvs-1.11-8.i386.rpm
prior to
cvs-doc-ps-1.11-8.i386.rpm
OpenLinux 3.1 Server prior to cvs-1.11-8.i386.rpm
prior to
cvs-doc-ps-1.11-8.i386.rpm
OpenLinux 3.1 Workstation prior to cvs-1.11-8.i386.rpm
prior to
cvs-doc-ps-1.11-8.i386.rpm
3. Solution
The proper solution is to install the latest packages. Many
customers find it easier to use the Caldera System Updater,
called
cupdate (or kcupdate under the KDE environment), to update these
packages rather than downloading and installing them by hand.
4. OpenLinux 3.1.1 Server
4.1 Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-035.0
/RPMS
4.2 Packages
446921ba85f2f865d698060ab344d189 cvs-1.11-8.i386.rpm
11ddbffdbf9310b24364b2b91d851acc
cvs-doc-ps-1.11-8.i386.rpm
4.3 Installation
rpm -Fvh cvs-1.11-8.i386.rpm
rpm -Fvh cvs-doc-ps-1.11-8.i386.rpm
4.4 Source Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-035.0
/SRPMS
4.5 Source Packages
0e5b474050456ed691d77fc8ce5825be cvs-1.11-8.src.rpm
5. OpenLinux 3.1.1 Workstation
5.1 Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2002-
035.0/RPMS
5.2 Packages
d24451d87b1c7424f12bb41d4873c3df cvs-1.11-8.i386.rpm
035d93df5ab69f025f7d08a583977658
cvs-doc-ps-1.11-8.i386.rpm
5.3 Installation
rpm -Fvh cvs-1.11-8.i386.rpm
rpm -Fvh cvs-doc-ps-1.11-8.i386.rpm
5.4 Source Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2002-
035.0/SRPMS
5.5 Source Packages
ba797e325ccc15beff8506f27ee4436e cvs-1.11-8.src.rpm
6. OpenLinux 3.1 Server
6.1 Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-035.0/R
PMS
6.2 Packages
1f3a09e4fcc1a8a0d011a6e7fcd0d810 cvs-1.11-8.i386.rpm
ff3e5b2acdd60e4b0492b212603a0d23
cvs-doc-ps-1.11-8.i386.rpm
6.3 Installation
rpm -Fvh cvs-1.11-8.i386.rpm
rpm -Fvh cvs-doc-ps-1.11-8.i386.rpm
6.4 Source Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-035.0/S
RPMS
6.5 Source Packages
c54cf8725ca2d24535e3abe86524fcb8 cvs-1.11-8.src.rpm
7. OpenLinux 3.1 Workstation
7.1 Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2002-03
5.0/RPMS
7.2 Packages
cf5125e9586da6217df51051f66eb8d6 cvs-1.11-8.i386.rpm
4bce0b96a28195c75878515b6a37777d
cvs-doc-ps-1.11-8.i386.rpm
7.3 Installation
rpm -Fvh cvs-1.11-8.i386.rpm
rpm -Fvh cvs-doc-ps-1.11-8.i386.rpm
7.4 Source Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2002-03
5.0/SRPMS
7.5 Source Packages
05f22c4bfcb98b826fcbb85e1d81f637 cvs-1.11-8.src.rpm
8. References
Specific references for this advisory:
http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0081.html
Caldera security resources:
http://www.caldera.com/support/security/index.html
This security fix closes Caldera incidents sr865452, fz521139,
erg712068.
9. Disclaimer
Caldera International, Inc. is not responsible for the misuse
of any of the information we provide on this website and/or
through our security advisories. Our advisories are a service
to our customers intended to promote secure installation and
use of Caldera products.
10. Acknowledgements
David Reign (davidreign@hotmail.com) discovered and reported
this vulnerability. Larry Jones (the maintainer) provided more
information, and a fix for the issue.
________________________________________________________________________
______
-----Original Message-----
From: security@caldera.com [mailto:security@caldera.com]
Sent: Thursday, August 08, 2002 8:01 PM
To: bugtraq@securityfocus.com; announce@lists.caldera.com;
security-alerts@linuxsecurity.com; full-disclosure@lists.netsys.com
Subject: [Full-Disclosure] Security Update: [CSSA-2002-035.0] Linux:
local off by one in cvsd
To: bugtraq@securityfocus.com announce@lists.caldera.com
security-alerts@linuxsecurity.com full-disclosure@lists.netsys.com
________________________________________________________________________
______
Caldera International, Inc. Security Advisory
Subject: Linux: local off by one in cvsd
Advisory number: CSSA-2002-035.0
Issue date: 2002 August 08
Cross reference:
________________________________________________________________________
______
1. Problem Description
There is a locally exploitable vulnerability in the cvsd
program.
2. Vulnerable Supported Versions
System Package
----------------------------------------------------------------------
OpenLinux 3.1.1 Server prior to cvs-1.11-8.i386.rpm
prior to
cvs-doc-ps-1.11-8.i386.rpm
OpenLinux 3.1.1 Workstation prior to cvs-1.11-8.i386.rpm
prior to
cvs-doc-ps-1.11-8.i386.rpm
OpenLinux 3.1 Server prior to cvs-1.11-8.i386.rpm
prior to
cvs-doc-ps-1.11-8.i386.rpm
OpenLinux 3.1 Workstation prior to cvs-1.11-8.i386.rpm
prior to
cvs-doc-ps-1.11-8.i386.rpm
3. Solution
The proper solution is to install the latest packages. Many
customers find it easier to use the Caldera System Updater,
called
cupdate (or kcupdate under the KDE environment), to update these
packages rather than downloading and installing them by hand.
4. OpenLinux 3.1.1 Server
4.1 Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-035.0
/RPMS
4.2 Packages
446921ba85f2f865d698060ab344d189 cvs-1.11-8.i386.rpm
11ddbffdbf9310b24364b2b91d851acc
cvs-doc-ps-1.11-8.i386.rpm
4.3 Installation
rpm -Fvh cvs-1.11-8.i386.rpm
rpm -Fvh cvs-doc-ps-1.11-8.i386.rpm
4.4 Source Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-035.0
/SRPMS
4.5 Source Packages
0e5b474050456ed691d77fc8ce5825be cvs-1.11-8.src.rpm
5. OpenLinux 3.1.1 Workstation
5.1 Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2002-
035.0/RPMS
5.2 Packages
d24451d87b1c7424f12bb41d4873c3df cvs-1.11-8.i386.rpm
035d93df5ab69f025f7d08a583977658
cvs-doc-ps-1.11-8.i386.rpm
5.3 Installation
rpm -Fvh cvs-1.11-8.i386.rpm
rpm -Fvh cvs-doc-ps-1.11-8.i386.rpm
5.4 Source Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2002-
035.0/SRPMS
5.5 Source Packages
ba797e325ccc15beff8506f27ee4436e cvs-1.11-8.src.rpm
6. OpenLinux 3.1 Server
6.1 Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-035.0/R
PMS
6.2 Packages
1f3a09e4fcc1a8a0d011a6e7fcd0d810 cvs-1.11-8.i386.rpm
ff3e5b2acdd60e4b0492b212603a0d23
cvs-doc-ps-1.11-8.i386.rpm
6.3 Installation
rpm -Fvh cvs-1.11-8.i386.rpm
rpm -Fvh cvs-doc-ps-1.11-8.i386.rpm
6.4 Source Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-035.0/S
RPMS
6.5 Source Packages
c54cf8725ca2d24535e3abe86524fcb8 cvs-1.11-8.src.rpm
7. OpenLinux 3.1 Workstation
7.1 Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2002-03
5.0/RPMS
7.2 Packages
cf5125e9586da6217df51051f66eb8d6 cvs-1.11-8.i386.rpm
4bce0b96a28195c75878515b6a37777d
cvs-doc-ps-1.11-8.i386.rpm
7.3 Installation
rpm -Fvh cvs-1.11-8.i386.rpm
rpm -Fvh cvs-doc-ps-1.11-8.i386.rpm
7.4 Source Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2002-03
5.0/SRPMS
7.5 Source Packages
05f22c4bfcb98b826fcbb85e1d81f637 cvs-1.11-8.src.rpm
8. References
Specific references for this advisory:
http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0081.html
Caldera security resources:
http://www.caldera.com/support/security/index.html
This security fix closes Caldera incidents sr865452, fz521139,
erg712068.
9. Disclaimer
Caldera International, Inc. is not responsible for the misuse
of any of the information we provide on this website and/or
through our security advisories. Our advisories are a service
to our customers intended to promote secure installation and
use of Caldera products.
10. Acknowledgements
David Reign (davidreign@hotmail.com) discovered and reported
this vulnerability. Larry Jones (the maintainer) provided more
information, and a fix for the issue.
________________________________________________________________________
______