lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 7 Aug 2004 18:53:43 +0200
From: Robin Rosenberg <robin.rosenberg.lists@...ire.com>
To: bugtraq@...urityfocus.com
Subject: Re: CVS woes: .cvspass


On Wednesday 04 August 2004 22.35, Greg A. Woods wrote:
> [ On Thursday, July 29, 2004 at 16:30:07 (+0300), Delian Krustev wrote: ]
>
> > Subject: Re: CVS woes: .cvspass
> >
> > On Tuesday 27 July 2004 23:20, Greg A. Woods wrote:
> > > Anyone using the CVS pserver mechanism for anything other than totally
> > > anonymous access gets only what they deserve.
> >
> > brr, do not forget that the security might be guaranteed on different
> > layers. E.g. ipsec secures the insecure protocols(the ones that transfer
> > data in plain text or with weak encryption), such as telnet or cvs
> > with pserver.
>
> Nope, sorry, but that's just not possible, at least not with CVS pserver.
>
> The unix security model, within which CVS is designed and implemented to
> work, _requires_ unique user-IDs for each and every unique human user.
[...]
> CVS is not, and cannot be, a security tool so running it as root and
> pretending to have it do all your authentication and authorisation flies

"pretending"? 

With 1.12 CVS can (and that seems to be the default) use system
authentication methods like PAM and does setuid etc before doing any cvs 
operations, which takes places as the respective user. It won't even let
me add users in CVSROOT/passwd. It does allow me to set a different password
for CVS acess though.

But also 1.11 did setuid etc before doing CVS operations and perhaps earlier 
versions also, but I'm not sure about that.

-- robin



Powered by blists - more mailing lists