Debian Security Advisory

cvsweb -- unauthorized remote code execution

Date Reported:
16 Jul 2000
Affected Packages:
cvsweb
Vulnerable:
Yes
Security database references:
In Mitre's CVE dictionary: CVE-2000-0670.
More information:
The versions of cvsweb distributed in Debian GNU/Linux 2.1 (aka slink) as well as in the frozen (potato) and unstable (woody) distributions, are vulnerable to a remote shell exploit. An attacker with write access to the cvs repository can execute arbitrary code on the server, as the www-data user.

The vulnerability is fixed in version 109 of cvsweb for the current stable release (Debian GNU/Linux 2.1), in version 1.79-3potato1 for the frozen distribution, and in version 1.86-1 for the unstable distribution.

Fixed in:

Debian GNU/Linux 2.1 (slink):

Source:
http://security.debian.org/dists/slink/updates/source/cvsweb_109.dsc
http://security.debian.org/dists/slink/updates/source/cvsweb_109.tar.gz
Architecture-independent component:
http://security.debian.org/dists/slink/updates/binary-all/cvsweb_109_all.deb

Debian GNU/Linux 2.2 (potato):

Source:
http://http.us.debian.org/debian/dists/potato/main/source/devel/cvsweb_1.79-3potato1.diff.gz
http://http.us.debian.org/debian/dists/potato/main/source/devel/cvsweb_1.79-3potato1.dsc
http://http.us.debian.org/debian/dists/potato/main/source/devel/cvsweb_1.79.orig.tar.gz
Architecture-independent component:
http://http.us.debian.org/debian/dists/potato/main/binary-all/devel/cvsweb_1.79-3potato1.deb