June 9, 2004 2:36 PM PDT

More flaws foul security of open-source repository

Security researchers have found at least six more flaws in the open-software world's most popular program for maintaining code under development.

Get Up to Speed on...
Open source
Get the latest headlines and
company-specific news in our
expanded GUTS section.

According to a representative of the project that oversees the program, known as the Concurrent Versions System, the vulnerabilities include a flaw that could let an attacker take control of a CVS server from the Internet, putting the code repository's contents at risk. The flaws were discovered as part of an analysis of the program's code following the announcement last month of a similar set of issues.

The security flaws underscore the advice of CVS Project leaders, who say development teams should not be placing source-code repositories directly on the Internet. Rather, the repositories should be accessible only on private local networks or through VPNs (virtual private networks), said Derek Robert Price, one of three maintainers of the CVS Project and the project's release manager.

"We have always said that CVS is not secure," he said. "We have never made any quibbles about that."

Major open-source projects, including the Apache Foundation's Apache Web server and the GNOME and KDE Linux desktops, use the Concurrent Versions System to manage code under development. The software allows programmers to check in changed code, and it tracks the different versions of a program under development.

The major projects using the program were notified of the issues May 28. On Wednesday, the security holes were publicly announced.

The majority of the issues were found by two researchers who vetted the source code after the patch for previous flaws was released in May. One of the researchers, Stefan Esser, also found the previous security holes. The issue became even more serious when an online vandal apparently used the former vulnerabilities to gain access to the CVS Project's server and send an e-mail that said he had gained access. The project has retired that server and plans to analyze its files for evidence of the attack, Price said.

The project has already issued a software update to patch the issue, as has Linux seller SuSE. Other Linux distributions that include the software are expected to release updates this week.

1 comment

Join the conversation!
Add your comment
Subversion anyone?
All the more compelling reason to switch to Subversion.
Posted by (3 comments )
Reply Link Flag

Join the conversation

Add your comment

The posting of advertisements, profanity, or personal attacks is prohibited. Click here to review our Terms of Use.

What's Hot



RSS Feeds

Add headlines from CNET News to your homepage or feedreader.