This is the mail archive of the
gcc@gcc.gnu.org
mailing list for the GCC project.
Re: Security issue with cvs
- To: carlo at runaway dot xs4all dot nl (Carlo Wood)
- Subject: Re: Security issue with cvs
- From: Joe Buck <jbuck at synopsys dot com>
- Date: Thu, 13 Aug 98 10:38:59 PDT
- Cc: egcs at cygnus dot com
> as might be well known, there is a security problem with
> the read-only CVS access. The problem is that when someone
> manages to change or replace the CVSROOT/passwd file,
> then he or she can get root.
If I truly have read-only access, then how can I change or replace
CVSROOT/passwd?
(It is a security bug if folks with *write* access can change that
file, and depending on encoding, it may be a bug if I can fetch it).