CVS update [cvs1-11-x-branch]: /ccvs/

Tag: cvs1-11-x-branch
User: dprice  
Date: 05/04/14 07:29:17

Modified:
 /ccvs/
  ChangeLog, NEWS

Log:
 * NEWS: Note contrib Perl taint vulnerability fix.

File Changes:

Directory: /ccvs/
=================

File [changed]: ChangeLog
Url: https://ccvs.cvshome.org/source/browse/ccvs/ChangeLog?r1=1.692.2.201&r2=1.692.2.202
Delta lines:  +4 -0
-------------------
--- ChangeLog	23 Mar 2005 20:03:22 -0000	1.692.2.201
+++ ChangeLog	14 Apr 2005 14:29:14 -0000	1.692.2.202
@@ -1,3 +1,7 @@
+2005-04-14  Derek Price  <[email protected]>
+
+	* NEWS: Note contrib Perl taint vulnerability fix.
+
 2005-03-23  Derek Price  <[email protected]>
 
 	* ylwrap: New file.

File [changed]: NEWS
Url: https://ccvs.cvshome.org/source/browse/ccvs/NEWS?r1=1.116.2.125&r2=1.116.2.126
Delta lines:  +26 -0
--------------------
--- NEWS	15 Mar 2005 21:56:44 -0000	1.116.2.125
+++ NEWS	14 Apr 2005 14:29:14 -0000	1.116.2.126
@@ -1,6 +1,32 @@
 Changes since 1.11.19:
 **********************
 
+SERVER SECURITY FIXES
+
+* Thanks to a report from Craig Monson <[email protected]>, minor
+  potential vulnerabilities in the contributed Perl scripts have been fixed.
+  The confirmed vulnerability could allow the execution of arbitrary code on
+  the CVS server, but only if a user already had commit access and if one of
+  the contrib scripts was installed improperly, a condition which should have
+  been quickly visible to any administrator.  The complete description of the
+  problem is here: <https://ccvs.cvshome.org/issues/show_bug.cgi?id=224>.  If
+  you were making use of any of the contributed trigger scripts on a CVS
+  server, you should probably still replace them with the new versions, to be
+  on the safe side.
+
+  Unfortunately, our fix is incomplete.  Taint-checking has been enabled in all
+  the contributed Perl scripts intended to be run as trigger scripts, but no
+  attempt has been made to ensure that they still run in taint mode.  You will
+  most likely have to tweak the scripts in some way to make them run.  Please
+  send any patches you find necessary back to <[email protected]> so that we may
+  again ship fully enabled scripts in the future.
+
+  You should also make sure that any home-grown Perl scripts that you might
+  have installed as CVS triggers also have taint-checking enabled.  This can be
+  done by adding `-T' on the scripts' #! lines.  Please try running
+  `perldoc perlsec' if you would like more information on general Perl security
+  and taint-checking.
+
 BUG FIXES
 
 * Thanks to a report and a patch from Georg Scwharz <[email protected]>