CVS update: /ccvs/, /ccvs/contrib/

[email protected] 14 Apr 2005 15:45:02 -0000
Newsgroups gmane.comp.version-control.cvs.cvs
Message-ID <[email protected]>
User: dprice  
Date: 05/04/14 08:45:02

Modified:
 /ccvs/
  ChangeLog, NEWS
 /ccvs/contrib/
  ChangeLog, README, commit_prep.in, cvs_acls.in, log.in, log_accum.in,
  mfpipe.in, rcslock.in

Log:
 Merge changes from 1.11.x.

File Changes:

Directory: /ccvs/
=================

File [changed]: ChangeLog
Url: https://ccvs.cvshome.org/source/browse/ccvs/ChangeLog?r1=1.1192&r2=1.1193
Delta lines:  +4 -0
-------------------
--- ChangeLog	12 Apr 2005 18:18:31 -0000	1.1192
+++ ChangeLog	14 Apr 2005 15:45:00 -0000	1.1193
@@ -1,3 +1,7 @@
+2005-04-14  Derek Price  <[email protected]>
+
+	* NEWS: Note contrib Perl taint vulnerability fix.
+
 2005-04-12  Derek Price  <[email protected]>
 
 	* NEWS: Avoid self-aggrandizement.

File [changed]: NEWS
Url: https://ccvs.cvshome.org/source/browse/ccvs/NEWS?r1=1.309&r2=1.310
Delta lines:  +26 -0
--------------------
--- NEWS	12 Apr 2005 18:18:31 -0000	1.309
+++ NEWS	14 Apr 2005 15:45:00 -0000	1.310
@@ -1,6 +1,32 @@
 Changes since 1.12.11:
 **********************
 
+SERVER SECURITY FIXES
+
+* Thanks to a report from Craig Monson <[email protected]>, minor
+  potential vulnerabilities in the contributed Perl scripts have been fixed.
+  The confirmed vulnerability could allow the execution of arbitrary code on
+  the CVS server, but only if a user already had commit access and if one of
+  the contrib scripts was installed improperly, a condition which should have
+  been quickly visible to any administrator.  The complete description of the
+  problem is here: <https://ccvs.cvshome.org/issues/show_bug.cgi?id=224>.  If
+  you were making use of any of the contributed trigger scripts on a CVS
+  server, you should probably still replace them with the new versions, to be
+  on the safe side.
+
+  Unfortunately, our fix is incomplete.  Taint-checking has been enabled in all
+  the contributed Perl scripts intended to be run as trigger scripts, but no
+  attempt has been made to ensure that they still run in taint mode.  You will
+  most likely have to tweak the scripts in some way to make them run.  Please
+  send any patches you find necessary back to <[email protected]> so that we may
+  again ship fully enabled scripts in the future.
+
+  You should also make sure that any home-grown Perl scripts that you might
+  have installed as CVS triggers also have taint-checking enabled.  This can be
+  done by adding `-T' on the scripts' #! lines.  Please try running
+  `perldoc perlsec' if you would like more information on general Perl security
+  and taint-checking.
+
 NEW FEATURES
 
 * Thanks to a report from Ian Abbott <[email protected]>, a problem that caused

Directory: /ccvs/contrib/
=========================

File [changed]: ChangeLog
Url: https://ccvs.cvshome.org/source/browse/ccvs/contrib/ChangeLog?r1=1.149&r2=1.150
Delta lines:  +10 -0
--------------------
--- ChangeLog	23 Mar 2005 00:04:27 -0000	1.149
+++ ChangeLog	14 Apr 2005 15:45:00 -0000	1.150
@@ -1,3 +1,13 @@
+2005-04-14  Derek Price  <[email protected]>
+
+	* commit_prep.in, cvs_acls.in, log.in, log_accum.in, mfpipe.in,
+	rcslock.in: Enable taint checking and comment.  This closes cvshome.org
+	Issue #224.
+
+2005-04-08  Derek Price  <[email protected]>
+
+	* README: Correct my email address.
+
 2005-03-22  Mark D. Baushke  <[email protected]>
 
 	* Makefile.in: Regenerated.

File [changed]: README
Url: https://ccvs.cvshome.org/source/browse/ccvs/contrib/README?r1=1.20&r2=1.21
Delta lines:  +1 -2
-------------------
--- README	9 Dec 2004 09:49:21 -0000	1.20
+++ README	14 Apr 2005 15:45:00 -0000	1.21
@@ -67,8 +67,7 @@
 			useful.
 
 	debug_check_log	A shell script to help analyze sanity check failures.
-			Contributed by Derek R. Price
-			<[email protected]>
+			Contributed by Derek R. Price <[email protected]>.
 
 	descend		A shell script that can be used to recursively
 	descend.man	descend through a directory.  In CVS 1.2, this was

File [changed]: commit_prep.in
Url: https://ccvs.cvshome.org/source/browse/ccvs/contrib/commit_prep.in?r1=1.2&r2=1.3
Delta lines:  +20 -2
--------------------
--- commit_prep.in	7 Aug 2003 15:56:13 -0000	1.2
+++ commit_prep.in	14 Apr 2005 15:45:00 -0000	1.3
@@ -1,6 +1,24 @@
-#! @PERL@
+#! @PERL@ -T
 # -*-Perl-*-
-#
+
+###############################################################################
+###############################################################################
+###############################################################################
+#
+# THIS SCRIPT IS PROBABLY BROKEN.  REMOVING THE -T SWITCH ON THE #! LINE ABOVE
+# WOULD FIX IT, BUT THIS IS INSECURE.  WE RECOMMEND FIXING THE ERRORS WHICH THE
+# -T SWITCH WILL CAUSE PERL TO REPORT BEFORE RUNNING THIS SCRIPT FROM A CVS
+# SERVER TRIGGER.  PLEASE SEND PATCHES CONTAINING THE CHANGES YOU FIND
+# NECESSARY TO RUN THIS SCRIPT WITH THE TAINT-CHECKING ENABLED BACK TO THE
+# <[email protected]> MAILING LIST.
+#
+# For more on general Perl security and taint-checking, please try running the
+# `perldoc perlsec' command.
+#
+###############################################################################
+###############################################################################
+###############################################################################
+
 # Perl filter to handle pre-commit checking of files.  This program
 # records the last directory where commits will be taking place for
 # use by the log_accum.pl script.

File [changed]: cvs_acls.in
Url: https://ccvs.cvshome.org/source/browse/ccvs/contrib/cvs_acls.in?r1=1.6&r2=1.7
Delta lines:  +20 -2
--------------------
--- cvs_acls.in	25 Jan 2005 18:42:36 -0000	1.6
+++ cvs_acls.in	14 Apr 2005 15:45:00 -0000	1.7
@@ -1,6 +1,24 @@
-#! @PERL@
+#! @PERL@ -T
 # -*-Perl-*-
 
+###############################################################################
+###############################################################################
+###############################################################################
+#
+# THIS SCRIPT IS PROBABLY BROKEN.  REMOVING THE -T SWITCH ON THE #! LINE ABOVE
+# WOULD FIX IT, BUT THIS IS INSECURE.  WE RECOMMEND FIXING THE ERRORS WHICH THE
+# -T SWITCH WILL CAUSE PERL TO REPORT BEFORE RUNNING THIS SCRIPT FROM A CVS
+# SERVER TRIGGER.  PLEASE SEND PATCHES CONTAINING THE CHANGES YOU FIND
+# NECESSARY TO RUN THIS SCRIPT WITH THE TAINT-CHECKING ENABLED BACK TO THE
+# <[email protected]> MAILING LIST.
+#
+# For more on general Perl security and taint-checking, please try running the
+# `perldoc perlsec' command.
+#
+###############################################################################
+###############################################################################
+###############################################################################
+
 =head1 Name
 
 cvs_acls - Access Control List for CVS
@@ -205,7 +223,7 @@
 Additionally, it was built and tested under Red Hat Linux 7.3 using 
 PERL 5.6.1.
 
-$Id: cvs_acls.in,v 1.6 2005/01/25 18:42:36 mdb Exp $
+$Id: cvs_acls.in,v 1.7 2005/04/14 15:45:00 dprice Exp $
 
 This version is based on the 1.11.13 version of cvs_acls
 [email protected] (Peter Connolly) 

File [changed]: log.in
Url: https://ccvs.cvshome.org/source/browse/ccvs/contrib/log.in?r1=1.2&r2=1.3
Delta lines:  +20 -2
--------------------
--- log.in	17 Apr 2001 00:21:11 -0000	1.2
+++ log.in	14 Apr 2005 15:45:00 -0000	1.3
@@ -1,6 +1,24 @@
-#! @PERL@
+#! @PERL@ -T
 # -*-Perl-*-
-#
+
+###############################################################################
+###############################################################################
+###############################################################################
+#
+# THIS SCRIPT IS PROBABLY BROKEN.  REMOVING THE -T SWITCH ON THE #! LINE ABOVE
+# WOULD FIX IT, BUT THIS IS INSECURE.  WE RECOMMEND FIXING THE ERRORS WHICH THE
+# -T SWITCH WILL CAUSE PERL TO REPORT BEFORE RUNNING THIS SCRIPT FROM A CVS
+# SERVER TRIGGER.  PLEASE SEND PATCHES CONTAINING THE CHANGES YOU FIND
+# NECESSARY TO RUN THIS SCRIPT WITH THE TAINT-CHECKING ENABLED BACK TO THE
+# <[email protected]> MAILING LIST.
+#
+# For more on general Perl security and taint-checking, please try running the
+# `perldoc perlsec' command.
+#
+###############################################################################
+###############################################################################
+###############################################################################
+
 # XXX: FIXME: handle multiple '-f logfile' arguments
 #
 # XXX -- I HATE Perl!  This *will* be re-written in shell/awk/sed soon!

File [changed]: log_accum.in
Url: https://ccvs.cvshome.org/source/browse/ccvs/contrib/log_accum.in?r1=1.5&r2=1.6
Delta lines:  +20 -2
--------------------
--- log_accum.in	7 Sep 2004 05:15:05 -0000	1.5
+++ log_accum.in	14 Apr 2005 15:45:00 -0000	1.6
@@ -1,6 +1,24 @@
-#! @PERL@
+#! @PERL@ -T
 # -*-Perl-*-
-#
+
+###############################################################################
+###############################################################################
+###############################################################################
+#
+# THIS SCRIPT IS PROBABLY BROKEN.  REMOVING THE -T SWITCH ON THE #! LINE ABOVE
+# WOULD FIX IT, BUT THIS IS INSECURE.  WE RECOMMEND FIXING THE ERRORS WHICH THE
+# -T SWITCH WILL CAUSE PERL TO REPORT BEFORE RUNNING THIS SCRIPT FROM A CVS
+# SERVER TRIGGER.  PLEASE SEND PATCHES CONTAINING THE CHANGES YOU FIND
+# NECESSARY TO RUN THIS SCRIPT WITH THE TAINT-CHECKING ENABLED BACK TO THE
+# <[email protected]> MAILING LIST.
+#
+# For more on general Perl security and taint-checking, please try running the
+# `perldoc perlsec' command.
+#
+###############################################################################
+###############################################################################
+###############################################################################
+
 # Perl filter to handle the log messages from the checkin of files in
 # a directory.  This script will group the lists of files by log
 # message, and mail a single consolidated log message at the end of

File [changed]: mfpipe.in
Url: https://ccvs.cvshome.org/source/browse/ccvs/contrib/mfpipe.in?r1=1.1&r2=1.2
Delta lines:  +20 -2
--------------------
--- mfpipe.in	5 Jan 2001 18:18:18 -0000	1.1
+++ mfpipe.in	14 Apr 2005 15:45:00 -0000	1.2
@@ -1,6 +1,24 @@
-#! @PERL@
+#! @PERL@ -T
 # -*-Perl-*-
-#
+
+###############################################################################
+###############################################################################
+###############################################################################
+#
+# THIS SCRIPT IS PROBABLY BROKEN.  REMOVING THE -T SWITCH ON THE #! LINE ABOVE
+# WOULD FIX IT, BUT THIS IS INSECURE.  WE RECOMMEND FIXING THE ERRORS WHICH THE
+# -T SWITCH WILL CAUSE PERL TO REPORT BEFORE RUNNING THIS SCRIPT FROM A CVS
+# SERVER TRIGGER.  PLEASE SEND PATCHES CONTAINING THE CHANGES YOU FIND
+# NECESSARY TO RUN THIS SCRIPT WITH THE TAINT-CHECKING ENABLED BACK TO THE
+# <[email protected]> MAILING LIST.
+#
+# For more on general Perl security and taint-checking, please try running the
+# `perldoc perlsec' command.
+#
+###############################################################################
+###############################################################################
+###############################################################################
+
 # From: [email protected] (John Clyne)
 # Date: Fri, 28 Feb 92 09:54:21 MST
 # 

File [changed]: rcslock.in
Url: https://ccvs.cvshome.org/source/browse/ccvs/contrib/rcslock.in?r1=1.1&r2=1.2
Delta lines:  +19 -1
--------------------
--- rcslock.in	5 Jan 2001 18:18:18 -0000	1.1
+++ rcslock.in	14 Apr 2005 15:45:00 -0000	1.2
@@ -1,6 +1,24 @@
-#! @PERL@
+#! @PERL@ -T
 # -*-Perl-*-
 
+###############################################################################
+###############################################################################
+###############################################################################
+#
+# THIS SCRIPT IS PROBABLY BROKEN.  REMOVING THE -T SWITCH ON THE #! LINE ABOVE
+# WOULD FIX IT, BUT THIS IS INSECURE.  WE RECOMMEND FIXING THE ERRORS WHICH THE
+# -T SWITCH WILL CAUSE PERL TO REPORT BEFORE RUNNING THIS SCRIPT FROM A CVS
+# SERVER TRIGGER.  PLEASE SEND PATCHES CONTAINING THE CHANGES YOU FIND
+# NECESSARY TO RUN THIS SCRIPT WITH THE TAINT-CHECKING ENABLED BACK TO THE
+# <[email protected]> MAILING LIST.
+#
+# For more on general Perl security and taint-checking, please try running the
+# `perldoc perlsec' command.
+#
+###############################################################################
+###############################################################################
+###############################################################################
+
 # Author: John Rouillard ([email protected])
 # Supported: Yeah right. (Well what do you expect for 2 hours work?)
 # Blame-to: [email protected]