bugtraq - Re: CVS woes: .cvspass

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <m1BpYQk-0002SfC@proven.weird.com>
Date: Tue, 27 Jul 2004 16:20:10 -0400 (EDT)
From: "Greg A. Woods" <woods@...rd.com>
To: Chiaki <ishikawa@...rim.or.jp>
Cc: bugtraq@...urityfocus.com
Subject: Re: CVS woes: .cvspass

[ On Tuesday, July 27, 2004 at 03:00:52 (+0900), Chiaki wrote: ]
> Subject: CVS woes: .cvspass
>
> The file revision control system, CVS,
> stores often used server's password in
> users .cvspass file. (When we use pserver mode to set up a
> central repository and access it from remote workstations,
> that is.)

Anyone using the CVS pserver mechanism for anything other than totally
anonymous access gets only what they deserve.

If you want to keep your CVS repository secure then don't try to use CVS
as a security tool -- it wasn't designed for it, and it cannot be
"fixed" either (it's not a bug -- CVS is a version control tool, not a
security tool and CVS is designed _only_ to be executed by the unique
user performing operations on repository).

Use SSH or some other secure remote job execution tool to create a
secure connection for CVS to work with.

-- 
						Greg A. Woods

+1 416 218-0098                  VE3TCP            RoboHack <woods@...ohack.ca>
Planix, Inc. <woods@...nix.com>          Secrets of the Weird <woods@...rd.com>