Re: [akr@M17N.ORG: cvs security problem]

[Karl Fogel]

Sorry -- good point.  I'll look at it in detail when I'm looking at it
in detail, which will be early next week.  In the meantime, I'll keep
my mouth shut. :-)

-K

Ian Lance Taylor <[EMAIL PROTECTED]> writes:
>    From: Karl Fogel <[EMAIL PROTECTED]>
>    Date: 28 Jul 2000 14:01:23 -0500
> 
>    Ian Lance Taylor <[EMAIL PROTECTED]> writes:
>    > This looks like a serious security problem.  It appears to open
>    > anonymous CVS servers to a wide range of attack.
> 
>    It looks serious, but not for anonymous-only servers, since anonymous
>    users can't commit.
> 
> What if I frob Update.prog?  I don't claim to understand all the cases
> here, but it appears that that will be run by `cvs update'.
> 
> Ian