===================================================================== CERT-Renater Note d'Information No. 2004/VULN256 _____________________________________________________________________ DATE : 25/05/2004 HARDWARE PLATFORM(S) : / OPERATING SYSTEM(S) : Systems running CVS. ====================================================================== ______________________________________________________________________________ SUSE Security Announcement Package: cvs Announcement-ID: SuSE-SA:2004:008 Date: Wed Apr 14 16:00:00 MEST 2004 Affected products: 8.0, 8.1, 8.2, 9.0 SuSE Firewall on CD 2 SuSE Linux Enterprise Server 7, 8 SLES 8 for IBM iSeries and IBM pSeries SuSE Linux Office Server UnitedLinux 1.0 Vulnerability Type: remote code execution Severity (1-10): 5 SUSE default package: No Cross References: Content of this advisory: 1) security vulnerability resolved: arbitrary file creation in cvs problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds: - neon - tcpdump - openssh - kdeprint/kdelibs3 - MPlayer - mailman - systat - apache2 - emil 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The Concurrent Versions System (CVS) offers tools which allow developers to share and maintain large software projects. During the analyzation of the CVS protocol and their implementation, the SuSE Security Team discovered a flaw within the handling of pathnames. Evil CVS servers could specify absolute pathnames during checkouts and updates, which allows to create arbitrary files with the permissions of the user invoking the CVS client. This could lead to a compromise of the system. Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. Intel i386 Platform: SuSE-9.0: ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/cvs-1.11.6-79.i586.rpm 392353d02948dee01fa98832841699be patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/cvs-1.11.6-79.i586.patch.rpm fd287ccde902d5a93ce54c141f4f888d source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/cvs-1.11.6-79.src.rpm f094e09f54e176747f7441d44c20e12c SuSE-8.2: ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/cvs-1.11.5-103.i586.rpm a690613adaf637365f8b99a91373f5cf patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/cvs-1.11.5-103.i586.patch.rpm 844400ec62905d78b9e196c311f49207 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/src/cvs-1.11.5-103.src.rpm 202d2afd939caff003fbe73f65977ee6 SuSE-8.1: ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/cvs-1.11.1p1-326.i586.rpm 90401ed5771c3570310c23efcd503bee patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/cvs-1.11.1p1-326.i586.patch.rpm 42335546a7937ccc0fc6173ba1697ed9 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/src/cvs-1.11.1p1-326.src.rpm ca6cb008ba8004635f9892552ed3e569 SuSE-8.0: ftp://ftp.suse.com/pub/suse/i386/update/8.0/d3/cvs-1.11.1p1-326.i386.rpm b24bca587706433d0cfa81ae96822e81 patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.0/d3/cvs-1.11.1p1-326.i386.patch.rpm b5df706c6862ade002714607ba6027f6 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/cvs-1.11.1p1-326.src.rpm 26b4e34fb562fdccf33f35bfde16a403 Opteron x86_64 Platform: SuSE-9.0: ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/cvs-1.11.6-78.x86_64.rpm dae12f94ea7eb35ed9b5172a8288d032 patch rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/cvs-1.11.6-78.x86_64.patch.rpm 07ca7acf86abd38e617a60e28dedfb0c source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/cvs-1.11.6-78.src.rpm 02d1e7f89a0f5372dc8a702032f4f4c2 ______________________________________________________________________________ 2) Pending vulnerabilities in SUSE Distributions and Workarounds: - neon The neon package contained various format string vulnerabilities which have been fixed. New packages are available on our FTP servers. Maintained products do not contain the neon package and are therefore not affected. (CAN-2004-0179) - tcpdump The tcpdump program contains a remotely exploitable denial of service condition in its ISAKMP packet handling. New tcpdump packages are currently being tested and will soon be available on our FTP servers. - openssh The scp program which is part of the openssh package allowed evil servers to trick clients into creating arbitrary files with permissions of the user invoking scp. New packages are available on our FTP servers. - kdeprint/kdelibs3 The kdeprint system called the ghostscript program without the -dSAFER option. This has been fixed. New packages are available on our FTP servers. The package is named "kdelibs3". Maintained products are not affected. - MPlayer The mplayer program contained a buffer overflow while escaping large URLs. This has been fixed. New MPlayer packages are currently being tested and will be available soon on our FTP servers. - mailman The mailing list manager mailman can be tricked to deny service by remote attackers. (CAN-2003-0991) New packages are available on our FTP servers. - sysstat This update close two cases of insecure temporary file handling in the isag code. New packages are available on our FTP servers. - apache2 This update fixes a memory leak in the mod_ssl module of apache2 (CAN-2004-0113), a possible remote DoS attack on accessing rarely used listening ports (CAN-2004-0174), and a problem with unescaped special characters in log files that could present a security hazard for terminal emulators (CAN-2003-0020). New packages are available on our FTP servers. - emil The emil mail filter conatins buffer overflows and format-string bugs that can be exploited remotely if emil is used in conjunction with procmail, sendmail and alike. (CAN-2004-0152, CAN-2004-0153) New packages are available on our FTP servers. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SUSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum after you downloaded the file from a SUSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security@suse.de), the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig to verify the signature of the package, where is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an un-installed rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SUSE in rpm packages for SUSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SUSE Linux distributions version 7.1 and thereafter install the key "build@suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the top-level directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SUSE runs two security mailing lists to which any interested party may subscribe: suse-security@suse.com - general/linux/SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an email to . suse-security-announce@suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an email to . For general information or the frequently asked questions (faq) send mail to: or respectively. ===================================================================== SUSE's security contact is or . The public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the clear-text signature shows proof of the authenticity of the text. SUSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key ====================================================================== ========================================================= Les serveurs de référence du CERT-Renater http://www.urec.fr/securite http://www.cru.fr/securite http://www.renater.fr ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 151 bd de l'Hopital | fax : 01-53-94-20-41 + + 75013 Paris | email: certsvp@renater.fr + =========================================================