Test ID:	1.3.6.1.4.1.25623.1.0.50674
Category:	Mandrake Local Security Checks
Title:	Mandrake Security Advisory MDKSA-2003:009 (cvs)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to cvs announced via advisory MDKSA-2003:009. Two vulnerabilities were discoverd by Stefen Esser in the cvs program. The first is an exploitable double free() bug within the server, which can be used to execute arbitray code on the CVS server. To accomplish this, the attacker must have an anonymous read-only login to the CVS server. The second vulnerability is with the Checkin-prog and Update-prog commands. If a client has write permission, he can use these commands to execute programs outside of the scope of CVS, the output of which will be sent as output to the client. This update fixes the double free() vulnerability and removes the Checkin-prog and Update-prog commands from CVS. Affected versions: 7.2, 8.0, 8.1, 8.2, 9.0, Single Network Firewall 7.2 Solution: To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. http://www.securityspace.com/smysecure/catid.html?in=MDKSA-2003:009 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0015 http://security.e-matters.de/advisories/012003.html Risk factor : High CVSS Score: 7.5
Cross-Ref:	BugTraq ID: 6650 Common Vulnerability Exposure (CVE) ID: CVE-2003-0015 http://www.securityfocus.com/bid/6650 Bugtraq: 20030122 [security@slackware.com: [slackware-security] New CVS packages available] (Google Search) http://marc.info/?l=bugtraq&m=104333092200589&w=2 Bugtraq: 20030124 Test program for CVS double-free. (Google Search) http://marc.info/?l=bugtraq&m=104342550612736&w=2 Bugtraq: 20030202 Exploit for CVS double free() for Linux pserver (Google Search) http://marc.info/?l=bugtraq&m=104428571204468&w=2 Caldera Security Advisory: CSSA-2003-006 http://www.cert.org/advisories/CA-2003-02.html CERT/CC vulnerability note: VU#650937 http://www.kb.cert.org/vuls/id/650937 Computer Incident Advisory Center Bulletin: N-032 http://www.ciac.org/ciac/bulletins/n-032.shtml Debian Security Information: DSA-233 (Google Search) http://www.debian.org/security/2003/dsa-233 FreeBSD Security Advisory: FreeBSD-SA-03:01 http://marc.info/?l=bugtraq&m=104438807203491&w=2 http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:009 http://security.e-matters.de/advisories/012003.html http://www.redhat.com/support/errata/RHSA-2003-012.html RedHat Security Advisories: RHSA-2003:013 http://rhn.redhat.com/errata/RHSA-2003-013.html SuSE Security Announcement: SuSE-SA:2003:0007 (Google Search) http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0028.html XForce ISS Database: cvs-doublefree-memory-corruption(11108) https://exchange.xforce.ibmcloud.com/vulnerabilities/11108
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.