Security issue with cvs

[Carlo Wood]

Hi,

as might be well known, there is a security problem with
the read-only CVS access.  The problem is that when someone
manages to change or replace the CVSROOT/passwd file,
then he or she can get root.

The only way to avoid this is by making the restrictions
on CVSROOT (and all directories above it) as tight as
on /etc, which is clearly not the case for egcs because
I can checkout the CVSROOT directory (which demands the
anonymous user to set locks in there).

I wrote a patch for cvs-1.9.29 (although 1.9.30 is out now))
which reads a file /etc/cvs.passwd instead of CVSROOT/passwd.
The normal procedure for adding changes like this into
cvs seems to be that people use it first, as a patch :).

I am using it already myself on coder-com.undernet.org,
and I advise "egcs" to use it too.

I did put it on the web.  You can get it at
http://www.xs4all.nl/~carlo17/cvs/
for now.

Thanks

-- 
 Carlo Wood  <carlo@runaway.xs4all.nl>