Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Security Vulnerability in cvs version 1.11.4 and lower!

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: julian AT openit.de (Julian v. Bock)
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Security Vulnerability in cvs version 1.11.4 and lower!
  • Date: Tue, 21 Jan 2003 15:04:44 +0100

Hi

>>>>> "AvM" == Arwed von Merkatz <v.merkatz AT gmx.net> writes:

AvM> Concurrent Versions System (CVS) is the dominant open-source
AvM> version control software that allows developers to access the
AvM> latest code using a network connection. CVS version 1.11.4 and
AvM> below contain a flaw that can be used by a remote attacker to
AvM> execute arbitrary code on the server.

Please note that this is only the case if you are running a pserver
(which is a bad idea anyway). Remote cvs via CVS_RSH is not affected.

I am not sure why they say it is badly documented. I remember having
read a warning about this 'feature' in the pserver docs.

Julian




Archive powered by MHonArc 2.6.24.

Top of Page