Re: [SECURITY] [DSA-422-1] multiple CVS improvements
On Tue, Jan 13, 2004 at 03:16:46PM +0100, Wichert Akkerman wrote:
> Since CVS performed no checking on what unix account was specified anyone
> who could modify the CVSROOT/passwd could gain access to all local users
> on the CVS server, including root.
I always thought that putting passwd into qa/CVSROOT/checkoutlist was
a bad idea -- good thing we never actually added any read/write pserver
users in there.
--
2. That which causes joy or happiness.
Reply to: