Re: [akr@M17N.ORG: cvs security problem]

[Pavel Roskin]

Hello!

On 28 Jul 2000, Karl Fogel wrote:

> Sorry -- good point.  I'll look at it in detail when I'm looking at it
> in detail, which will be early next week.  In the meantime, I'll keep
> my mouth shut. :-)

I hope that there is no immediate danger. Look at serve_update_prog() - it
checks whether commits are allowed and exits if they are not. It prints a
strange message though:

E Flag -u in modules not allowed in readonly mode

So unless somebody finds other holes, ther is no obvious way to exploit
CVS/Update.prog without having write access.

Regards,
Pavel Roskin