Re: Security issue with cvs

[Ian Lance Taylor <ian at cygnus dot com>]

   From: Carlo Wood <carlo@runaway.xs4all.nl>
   Date: Thu, 13 Aug 1998 02:37:12 +0200 (CEST)

   as might be well known, there is a security problem with
   the read-only CVS access.  The problem is that when someone
   manages to change or replace the CVSROOT/passwd file,
   then he or she can get root.

   The only way to avoid this is by making the restrictions
   on CVSROOT (and all directories above it) as tight as
   on /etc, which is clearly not the case for egcs because
   I can checkout the CVSROOT directory (which demands the
   anonymous user to set locks in there).

Currently, write access to the egcs repository is granted via SSH or
Kerberos, which means that people with write access can log in to the
egcs machine directly.  That means that they can already tamper with
the CVSROOT/passwd file, or generally break the security of the egcs
machine in a number of other ways.

While I think your patch is a good idea, and I think it should be
applied to the mainline CVS sources, applying it immediately on egcs
will not increase the security of egcs.

We must simply trust those people who are granted write access to the
repository, and keep backups.  The sources are at least somewhat more
secure than they were on the FSF machines.

In any case, obtaining root on egcs is not particularly interesting,
because it doesn't let you do much that you can't already do if you
can log in to the machine.

Using Kerberos or SSH has the disadvantage of permitting the users to
log in.  It has the advantage of providing an authentication method
which is (theoretically) as secure as the person using it, unlike the
CVS password server which is vulnerable to anybody who can read the
packets.

There are ways that we could improve the security of egcs.  I'm not
sure that anybody considers this to be especially important.

The egcs machine is outside of the Cygnus firewall, because we at
Cygnus know that the machine is insecure.

Ian