Re: [akr@M17N.ORG: cvs security problem]

[Ian Lance Taylor]

   Date: Fri, 28 Jul 2000 17:45:13 -0400 (EDT)
   From: [EMAIL PROTECTED] (Larry Jones)

   Ian Lance Taylor writes:

   > What if I frob Update.prog?  I don't claim to understand all the cases
   > here, but it appears that that will be run by `cvs update'.

   Update.prog just contains the name of the program to run, not the actual
   code.  If you can't commit, you can't upload arbitrary code to run, you
   can only run pre-existing code on the server, and you have no control
   over its input or arguments, so it's a very low-level threat.

As I read the code, Update.prog lets me have an arbitrary number of
arguments.  Look at run_setup.  Given that much leeway, I could do a
lot using /bin/sh -c.

Ian