lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20030402060905.GA46097@blossom.cjclark.org>
Date: Tue, 1 Apr 2003 22:09:05 -0800
From: "Crist J. Clark" <crist.clark@...bi.com>
To: bugtraq@...urityfocus.com, vuln-dev@...urityfocus.com
Subject: Re: Webserver CVS (In)Security


On Sun, Mar 30, 2003 at 04:42:02PM -0500, methodic@...pcap.net wrote:
[snip]

> In the end I chose to delete all CVS directories and files in my webroot
> with this command: find /www -name CVS -type d | xargs rm -rf which I
> have in a shell script that pushes the CVS site live. I didn't need them
> around and I didn't feel like messing around with httpd.conf. I'm not
> sure why people would want to keep them around.. maybe there's a tool
> that performs some sort of statistics. If that's the case, you should
> write a regex in your webserver's config file (if it has that option) to
> deny CVS and anything below it.

No, what you should be doing is a,

  $ cvs export web-root

And NOT a 'checkout.'
-- 
Crist J. Clark                     |     cjclark@...m.mit.edu
                                   |     cjclark@....edu
http://people.freebsd.org/~cjc/    |     cjc@...ebsd.org


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ