Public SourceMage Discussion List

[julian AT openit.de (Julian v. Bock)]

Hi

>>>>> "AvM" == Arwed von Merkatz <v.merkatz AT gmx.net> writes:

AvM>  Concurrent Versions System (CVS) is the dominant open-source
AvM> version control software that allows developers to access the
AvM> latest code using a network connection. CVS version 1.11.4 and
AvM> below contain a flaw that can be used by a remote attacker to
AvM> execute arbitrary code on the server.

Please note that this is only the case if you are running a pserver
(which is a bad idea anyway). Remote cvs via CVS_RSH is not affected.

I am not sure why they say it is badly documented. I remember having
read a warning about this 'feature' in the pserver docs.

Julian