CVS update: /ccvs/, /ccvs/contrib/
[email protected] 14 Apr 2005 15:45:02 -0000
| Newsgroups | gmane.comp.version-control.cvs.cvs |
|---|---|
| Message-ID | <[email protected]> |
User: dprice Date: 05/04/14 08:45:02 Modified: /ccvs/ ChangeLog, NEWS /ccvs/contrib/ ChangeLog, README, commit_prep.in, cvs_acls.in, log.in, log_accum.in, mfpipe.in, rcslock.in Log: Merge changes from 1.11.x. File Changes: Directory: /ccvs/ ================= File [changed]: ChangeLog Url: https://ccvs.cvshome.org/source/browse/ccvs/ChangeLog?r1=1.1192&r2=1.1193 Delta lines: +4 -0 ------------------- --- ChangeLog 12 Apr 2005 18:18:31 -0000 1.1192 +++ ChangeLog 14 Apr 2005 15:45:00 -0000 1.1193 @@ -1,3 +1,7 @@ +2005-04-14 Derek Price <[email protected]> + + * NEWS: Note contrib Perl taint vulnerability fix. + 2005-04-12 Derek Price <[email protected]> * NEWS: Avoid self-aggrandizement. File [changed]: NEWS Url: https://ccvs.cvshome.org/source/browse/ccvs/NEWS?r1=1.309&r2=1.310 Delta lines: +26 -0 -------------------- --- NEWS 12 Apr 2005 18:18:31 -0000 1.309 +++ NEWS 14 Apr 2005 15:45:00 -0000 1.310 @@ -1,6 +1,32 @@ Changes since 1.12.11: ********************** +SERVER SECURITY FIXES + +* Thanks to a report from Craig Monson <[email protected]>, minor + potential vulnerabilities in the contributed Perl scripts have been fixed. + The confirmed vulnerability could allow the execution of arbitrary code on + the CVS server, but only if a user already had commit access and if one of + the contrib scripts was installed improperly, a condition which should have + been quickly visible to any administrator. The complete description of the + problem is here: <https://ccvs.cvshome.org/issues/show_bug.cgi?id=224>. If + you were making use of any of the contributed trigger scripts on a CVS + server, you should probably still replace them with the new versions, to be + on the safe side. + + Unfortunately, our fix is incomplete. Taint-checking has been enabled in all + the contributed Perl scripts intended to be run as trigger scripts, but no + attempt has been made to ensure that they still run in taint mode. You will + most likely have to tweak the scripts in some way to make them run. Please + send any patches you find necessary back to <[email protected]> so that we may + again ship fully enabled scripts in the future. + + You should also make sure that any home-grown Perl scripts that you might + have installed as CVS triggers also have taint-checking enabled. This can be + done by adding `-T' on the scripts' #! lines. Please try running + `perldoc perlsec' if you would like more information on general Perl security + and taint-checking. + NEW FEATURES * Thanks to a report from Ian Abbott <[email protected]>, a problem that caused Directory: /ccvs/contrib/ ========================= File [changed]: ChangeLog Url: https://ccvs.cvshome.org/source/browse/ccvs/contrib/ChangeLog?r1=1.149&r2=1.150 Delta lines: +10 -0 -------------------- --- ChangeLog 23 Mar 2005 00:04:27 -0000 1.149 +++ ChangeLog 14 Apr 2005 15:45:00 -0000 1.150 @@ -1,3 +1,13 @@ +2005-04-14 Derek Price <[email protected]> + + * commit_prep.in, cvs_acls.in, log.in, log_accum.in, mfpipe.in, + rcslock.in: Enable taint checking and comment. This closes cvshome.org + Issue #224. + +2005-04-08 Derek Price <[email protected]> + + * README: Correct my email address. + 2005-03-22 Mark D. Baushke <[email protected]> * Makefile.in: Regenerated. File [changed]: README Url: https://ccvs.cvshome.org/source/browse/ccvs/contrib/README?r1=1.20&r2=1.21 Delta lines: +1 -2 ------------------- --- README 9 Dec 2004 09:49:21 -0000 1.20 +++ README 14 Apr 2005 15:45:00 -0000 1.21 @@ -67,8 +67,7 @@ useful. debug_check_log A shell script to help analyze sanity check failures. - Contributed by Derek R. Price - <[email protected]> + Contributed by Derek R. Price <[email protected]>. descend A shell script that can be used to recursively descend.man descend through a directory. In CVS 1.2, this was File [changed]: commit_prep.in Url: https://ccvs.cvshome.org/source/browse/ccvs/contrib/commit_prep.in?r1=1.2&r2=1.3 Delta lines: +20 -2 -------------------- --- commit_prep.in 7 Aug 2003 15:56:13 -0000 1.2 +++ commit_prep.in 14 Apr 2005 15:45:00 -0000 1.3 @@ -1,6 +1,24 @@ -#! @PERL@ +#! @PERL@ -T # -*-Perl-*- -# + +############################################################################### +############################################################################### +############################################################################### +# +# THIS SCRIPT IS PROBABLY BROKEN. REMOVING THE -T SWITCH ON THE #! LINE ABOVE +# WOULD FIX IT, BUT THIS IS INSECURE. WE RECOMMEND FIXING THE ERRORS WHICH THE +# -T SWITCH WILL CAUSE PERL TO REPORT BEFORE RUNNING THIS SCRIPT FROM A CVS +# SERVER TRIGGER. PLEASE SEND PATCHES CONTAINING THE CHANGES YOU FIND +# NECESSARY TO RUN THIS SCRIPT WITH THE TAINT-CHECKING ENABLED BACK TO THE +# <[email protected]> MAILING LIST. +# +# For more on general Perl security and taint-checking, please try running the +# `perldoc perlsec' command. +# +############################################################################### +############################################################################### +############################################################################### + # Perl filter to handle pre-commit checking of files. This program # records the last directory where commits will be taking place for # use by the log_accum.pl script. File [changed]: cvs_acls.in Url: https://ccvs.cvshome.org/source/browse/ccvs/contrib/cvs_acls.in?r1=1.6&r2=1.7 Delta lines: +20 -2 -------------------- --- cvs_acls.in 25 Jan 2005 18:42:36 -0000 1.6 +++ cvs_acls.in 14 Apr 2005 15:45:00 -0000 1.7 @@ -1,6 +1,24 @@ -#! @PERL@ +#! @PERL@ -T # -*-Perl-*- +############################################################################### +############################################################################### +############################################################################### +# +# THIS SCRIPT IS PROBABLY BROKEN. REMOVING THE -T SWITCH ON THE #! LINE ABOVE +# WOULD FIX IT, BUT THIS IS INSECURE. WE RECOMMEND FIXING THE ERRORS WHICH THE +# -T SWITCH WILL CAUSE PERL TO REPORT BEFORE RUNNING THIS SCRIPT FROM A CVS +# SERVER TRIGGER. PLEASE SEND PATCHES CONTAINING THE CHANGES YOU FIND +# NECESSARY TO RUN THIS SCRIPT WITH THE TAINT-CHECKING ENABLED BACK TO THE +# <[email protected]> MAILING LIST. +# +# For more on general Perl security and taint-checking, please try running the +# `perldoc perlsec' command. +# +############################################################################### +############################################################################### +############################################################################### + =head1 Name cvs_acls - Access Control List for CVS @@ -205,7 +223,7 @@ Additionally, it was built and tested under Red Hat Linux 7.3 using PERL 5.6.1. -$Id: cvs_acls.in,v 1.6 2005/01/25 18:42:36 mdb Exp $ +$Id: cvs_acls.in,v 1.7 2005/04/14 15:45:00 dprice Exp $ This version is based on the 1.11.13 version of cvs_acls [email protected] (Peter Connolly) File [changed]: log.in Url: https://ccvs.cvshome.org/source/browse/ccvs/contrib/log.in?r1=1.2&r2=1.3 Delta lines: +20 -2 -------------------- --- log.in 17 Apr 2001 00:21:11 -0000 1.2 +++ log.in 14 Apr 2005 15:45:00 -0000 1.3 @@ -1,6 +1,24 @@ -#! @PERL@ +#! @PERL@ -T # -*-Perl-*- -# + +############################################################################### +############################################################################### +############################################################################### +# +# THIS SCRIPT IS PROBABLY BROKEN. REMOVING THE -T SWITCH ON THE #! LINE ABOVE +# WOULD FIX IT, BUT THIS IS INSECURE. WE RECOMMEND FIXING THE ERRORS WHICH THE +# -T SWITCH WILL CAUSE PERL TO REPORT BEFORE RUNNING THIS SCRIPT FROM A CVS +# SERVER TRIGGER. PLEASE SEND PATCHES CONTAINING THE CHANGES YOU FIND +# NECESSARY TO RUN THIS SCRIPT WITH THE TAINT-CHECKING ENABLED BACK TO THE +# <[email protected]> MAILING LIST. +# +# For more on general Perl security and taint-checking, please try running the +# `perldoc perlsec' command. +# +############################################################################### +############################################################################### +############################################################################### + # XXX: FIXME: handle multiple '-f logfile' arguments # # XXX -- I HATE Perl! This *will* be re-written in shell/awk/sed soon! File [changed]: log_accum.in Url: https://ccvs.cvshome.org/source/browse/ccvs/contrib/log_accum.in?r1=1.5&r2=1.6 Delta lines: +20 -2 -------------------- --- log_accum.in 7 Sep 2004 05:15:05 -0000 1.5 +++ log_accum.in 14 Apr 2005 15:45:00 -0000 1.6 @@ -1,6 +1,24 @@ -#! @PERL@ +#! @PERL@ -T # -*-Perl-*- -# + +############################################################################### +############################################################################### +############################################################################### +# +# THIS SCRIPT IS PROBABLY BROKEN. REMOVING THE -T SWITCH ON THE #! LINE ABOVE +# WOULD FIX IT, BUT THIS IS INSECURE. WE RECOMMEND FIXING THE ERRORS WHICH THE +# -T SWITCH WILL CAUSE PERL TO REPORT BEFORE RUNNING THIS SCRIPT FROM A CVS +# SERVER TRIGGER. PLEASE SEND PATCHES CONTAINING THE CHANGES YOU FIND +# NECESSARY TO RUN THIS SCRIPT WITH THE TAINT-CHECKING ENABLED BACK TO THE +# <[email protected]> MAILING LIST. +# +# For more on general Perl security and taint-checking, please try running the +# `perldoc perlsec' command. +# +############################################################################### +############################################################################### +############################################################################### + # Perl filter to handle the log messages from the checkin of files in # a directory. This script will group the lists of files by log # message, and mail a single consolidated log message at the end of File [changed]: mfpipe.in Url: https://ccvs.cvshome.org/source/browse/ccvs/contrib/mfpipe.in?r1=1.1&r2=1.2 Delta lines: +20 -2 -------------------- --- mfpipe.in 5 Jan 2001 18:18:18 -0000 1.1 +++ mfpipe.in 14 Apr 2005 15:45:00 -0000 1.2 @@ -1,6 +1,24 @@ -#! @PERL@ +#! @PERL@ -T # -*-Perl-*- -# + +############################################################################### +############################################################################### +############################################################################### +# +# THIS SCRIPT IS PROBABLY BROKEN. REMOVING THE -T SWITCH ON THE #! LINE ABOVE +# WOULD FIX IT, BUT THIS IS INSECURE. WE RECOMMEND FIXING THE ERRORS WHICH THE +# -T SWITCH WILL CAUSE PERL TO REPORT BEFORE RUNNING THIS SCRIPT FROM A CVS +# SERVER TRIGGER. PLEASE SEND PATCHES CONTAINING THE CHANGES YOU FIND +# NECESSARY TO RUN THIS SCRIPT WITH THE TAINT-CHECKING ENABLED BACK TO THE +# <[email protected]> MAILING LIST. +# +# For more on general Perl security and taint-checking, please try running the +# `perldoc perlsec' command. +# +############################################################################### +############################################################################### +############################################################################### + # From: [email protected] (John Clyne) # Date: Fri, 28 Feb 92 09:54:21 MST # File [changed]: rcslock.in Url: https://ccvs.cvshome.org/source/browse/ccvs/contrib/rcslock.in?r1=1.1&r2=1.2 Delta lines: +19 -1 -------------------- --- rcslock.in 5 Jan 2001 18:18:18 -0000 1.1 +++ rcslock.in 14 Apr 2005 15:45:00 -0000 1.2 @@ -1,6 +1,24 @@ -#! @PERL@ +#! @PERL@ -T # -*-Perl-*- +############################################################################### +############################################################################### +############################################################################### +# +# THIS SCRIPT IS PROBABLY BROKEN. REMOVING THE -T SWITCH ON THE #! LINE ABOVE +# WOULD FIX IT, BUT THIS IS INSECURE. WE RECOMMEND FIXING THE ERRORS WHICH THE +# -T SWITCH WILL CAUSE PERL TO REPORT BEFORE RUNNING THIS SCRIPT FROM A CVS +# SERVER TRIGGER. PLEASE SEND PATCHES CONTAINING THE CHANGES YOU FIND +# NECESSARY TO RUN THIS SCRIPT WITH THE TAINT-CHECKING ENABLED BACK TO THE +# <[email protected]> MAILING LIST. +# +# For more on general Perl security and taint-checking, please try running the +# `perldoc perlsec' command. +# +############################################################################### +############################################################################### +############################################################################### + # Author: John Rouillard ([email protected]) # Supported: Yeah right. (Well what do you expect for 2 hours work?) # Blame-to: [email protected]