Stories
Slash Boxes
Comments
NOTE: use Perl; is on undef hiatus. You can read content, but you can't post it. More info will be forthcoming forthcomingly.

All the Perl that's Practical to Extract and Report

The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
 Full
 Abbreviated
 Hidden
More | Login | Reply
Loading... please wait.
  • Do you run CVS pserver as root? In this case "hacker" could create CVS login entry which can give him/her root rights.

    For example:

    # access CVS as root with alternative password
    root:HACKER'S_CRYPTED_PASSWORD
    # alias some CVS login name to root UID
    hacker:HACKER'S_CRYPTED_PASSWORD:root

    Have you checked if commitinfo/loginfo/etc files are not modified. They can be used to run arbitrary code.

    You may want to check if you don't have any rootkits on your computer. Try www.chkrootkit.org [chkrootkit.org].

    --

    Ilya Martynov (http://martynov.org/ [martynov.org])

    • Here's the log entry in it's entirety:

      Date:   Saturday May 18, 2002 @ 8:10
      Author: cvs-axkit
       
      Update of /home/cvs/CVSROOT
      In directory ted:/tmp/cvs-serv32715
       
      Modified Files:
              passwd
      Log Message:
      hmm, try that again
       
      Index: passwd
      ===================================================================
      RCS file: /home/cvs/CVSROOT/passwd,v
      retrieving revision 1.1
      retrieving revision 1.2
      diff -b -u -r1.1 -r1.2
      --- passwd      2002/05/18 07:06:38 

  • find / -mtime 1
    • Wouldn't you know I did an apt-get update yesterday evening, making that next to useless. However a check of files modified more recently than something I know I modified yesterday evening before going to bed didn't reveal anything scary.

      Neither did chkrootkit.

      I hate this sort of thing. It feels like such a waste of my day - especially when it's targetted at open source resources like my server. The jollies of the few ruin it for the rest of us.
  • that's why you want to get your stuff hosted by the ASF or at perl.org; others will take care of most such worries and hassles for you! :-)
    --

    -- ask bjoern hansen [askbjoernhansen.com], !try; do();

    • Well I host AxKit on apache.org. However that still leaves approx 60 projects in my CVS server... I suppose I could bump every single damn one onto sourceforge, but really, do I want to do that? Some of course are private projects (but then if they were just private projects I wouldn't need anoncvs I guess) which I couldn't host anywhere but here.
  • I'm way into using CVSROOT=:ext:user@host:/path/to/repos CVS_RSH=ssh. It's easier to set up than pserver, and probably more secure. I'm pretty sure you could set up an account with no login shell and only read-only access to the repository files and make it work. (But I've never tried it, so YMWV.)

    I hope no damage was done. Maybe the guy didn't know what he was doing and just did all that accidentally (hence the log message)? (Or was just trying something out to see if it would work, as opposed to tr

    --
    J. David works really hard, has a passion for writing good software, and knows many of the world's best Perl programmers
    • I'm considering dropping pserver. I allow it only for anonymous access right now, because people like to follow my projects, and I also prefer people to submit patches against current CVS.

      But if it's going to be a security risk then I'll just kill that.