On Wed, Sep 08, 2004 at 10:01:23AM -0500, Chris wrote: > While running portaudit, I get the complaint; > > Affected package: FreeBSD-502010 > Type of problem: multiple vulnerabilities in the cvs server code. > Reference: > <http://www.FreeBSD.org/ports/portaudit/d2102505-f03d-11d8-81b0-000347a4fa7d.html> > Note: To disable this check add the uuid to `portaudit_fixed' in > /usr/local/etc/portaudit.conf > > Am I to assume this is only if you run a cvs server? OR - > does this relate to the SA's put out earlier this year about the src.
Did you read the referenced portaudit page or any of the links
supplied by it? There are several vulnerabilities, most of which
affect the CVS server, but one fairly minor that affects the CVS
client.
The FreeBSD advisory SA-O4:07.cvs refers to a different problem:
http://www.vuxml.org/freebsd/0792e7a7-8e37-11d8-90d1-0020ed76ef5a.html
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:07.cvs.asc
As you can see, the VuXML entry you're getting warnings about is dated
a month after the security advisory:
http://www.vuxml.org/freebsd/d2102505-f03d-11d8-81b0-000347a4fa7d.html
However, the update given in the security advisory is to a version of
CVS unaffected by either vulnerability. Update your system to the
latest patchlevel and the problem will be fixed.
Cheers,
Matthew
--
Dr Matthew J Seaman MA, D.Phil. 26 The Paddocks
Savill Way
PGP: http://www.infracaninophile.co.uk/pgpkey Marlow
Tel: +44 1628 476614 Bucks., SL7 1TH UK
pgpJcaR5lCWPz.pgp
Description: PGP signature
