bugConcurrent Versions System - Bugs: bug #20534, Security: cvs client too keen to...


bug #20534: Security: cvs client too keen to change permissions

Submitter:  Ed Avis <epaepa>
Submitted:  Thu 19 Jul 2007 04:02:36 PM UTC
Category:  Bug Report Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Release: 
Fixed Release:  None Fixed Feature Release:  None
* Mandatory Fields

Add a New Comment Rich Markup

Tue 11 Dec 2007 05:56:55 PM UTC, comment #2: 

This is still a problem with cvs-1.12.13 (contrary to the CVS FAQ which says that suid/sgid setting code has been removed).

Ed Avis <epaepa>
Thu 19 Jul 2007 04:03:55 PM UTC, comment #1: 

% cvs --version

Concurrent Versions System (CVS) 1.11.22 (client/server)

Ed Avis <epaepa>
Thu 19 Jul 2007 04:02:36 PM UTC, original submission:  

It seems that 'cvs update', when creating a new file in the working copy, copies permissions from the file in the repository to the local checked-out file.  That is probably fine for the read, write and execute bits, but it's dangerous to copy the suid or sgid flags.  This is a potential security hole - if an attacker can persuade you to connect to a CVS repository he controls and do a cvs update, then he can trick you into creating a suid binary owned by you.

To reproduce:

# First the user makes an ordinary CVS project and starts work.
% export CVSROOT=$HOME/cvsroot
% mkdir $CVSROOT
% cvs init
% mkdir ~/scratch
% cd ~/scratch
% cvs import -mmsg test a b
% cvs co test
% cd test
% echo '#!/bin/sh' >exe
% echo 'echo hello' >>exe
% chmod a+x exe
% cvs add exe
% cvs commit -mmsg exe

# Now let us suppose we are the attacker and we modify the
# permissions of exe,v in the repository.  Although not shown
# here, the exploit also works if the repository is owned by
# some other user, as long as the checking-out user has
# permission to create cvs lock files.
% cd $CVSROOT/test
% chmod u+s exe,v

# Now back to the ordinary user, who for whatever reason decides
# to remove his working copy of exe and check it out fresh.
% cd ~/scratch/test
% rm exe
% cvs update exe
% ls -l exe

# Expected result: cvs was sensible enough not to copy the suid
# bit, so the permissions will be rwxr-xr-x or similar.
# Actual result: permissions shown as -rwsr-xr-x

I'd suggest that the only permission bit that should be set in the working copy by cvs is the user execute bit.  The other permission bits are too dangerous to set without user intervention.  Especially don't set the suid or sgid bits.

Ed Avis <epaepa>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by epaepa (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.


    No changes have been made to this item

    Back to the top

    Powered by Savane 3.13-f762.
    Corresponding source code