Re: CVS Security Issues
Derek Robert Price <[email protected]>
| Newsgroups | gmane.comp.version-control.cvs.general,gmane.comp.version-control.cvs.bugs |
|---|---|
| Organization | Ximbiot <http://ximbiot.com> |
| Message-ID | <[email protected]> |
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Mike Sutton wrote:
>On 12/18/03 14:26:26, Derek Robert Price wrote:
>
>>Hash: SHA1
>>
>>The idea of both is to make it harder to overwrite the CVSROOT/passwd
>>file and gain root. I've actually just commited a fix that will be
>>released soon with 1.11.11 & 1.12.5 which causes CVS to refuse to
>>continue running if the system user specified in CVSROOT/passwd maps to
>>root, but that doesn't stop anyone with write access to the
>>CVSROOT/passwd file from assuming any other UID they'd like.
>
>
>I posted a patch long ago that did just this for pserver connections.
>If the mapped name correlates to root (uid 0) then access is denied.
Sorry I missed your earlier patch, but I already commited this one and
it's in the 1.11.11 & 1.12.5 releases. This email was actually asking
about two different patches. :)
Derek
- --
*8^)
Email: [email protected]
Get CVS support at <http://ximbiot.com>!
- --
A handy telephone tip: Keep a small chalkboard near the phone. That
way, when a salesman calls, you can hold the receiver up to it and run
your fingernails across it until he hangs up.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
Comment: Using GnuPG with Netscape - http://enigmail.mozdev.org
iD8DBQE/4ihWLD1OTBfyMaQRAt5QAKD/ZjH7Hdb7dEjPCqpNZBn+QeXj+QCgkTU6
TU/hpcVRYOugh1/OUmn3GLA=
=7Kr9
-----END PGP SIGNATURE-----