[Fwd: Security Breach Alert - CVS Home File Download Area Compromised]

[Alan Dayley]

=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This is the last of the thread about a possible security breach at=20
www.cvshome.org.

The current conclusion is that there was and now is no security breach.  Th=
e=20
odd behavior os tagged as some interaction between the server and particula=
r=20
browsers and mime type handling.  The final message is repeated below for=20
your information.

Alan

=2D -------- Original Message --------
Subject: RE: Security Breach Alert - CVS Home File Download Area Compromised
Date: Fri, 28 Jan 2005 15:20:24 -0800
=46rom: Conrad T. Pino <Conrad@Pino.com>
To: Info CVS <info-cvs@gnu.org>, <announce-binaries@ccvs.cvshome.org>,=20
Bug CVS <bug-cvs@gnu.org>
CC: Kenneth Schwartzman <kenneth@collab.net>,=A0=A0=A0Philippe Turpault=20
<phil@collab.net>, Brian Noble <BNoble@collab.net>

Hi All,

I just got off the phone with Kenneth Schwartzman of Collab Net.
Kenneth reports the IT Engineering team investigated my report
and found no evidence to support a security breach.

The unexpected download behaviors I reported previously are now
believed to be a consequence of MIME type information supplied
by Apache 2.0 being acted upon differently by various browsers.

Collab Net IT Engineering, Mark Baushke, Larry Jones and I all
support this hypothesis.

Collab Net IT Engineering understands the desirability of having
a download content authentication method in place and will focus
attention on this issue after completing more pressing issues.

I'm closing this topic thread and will continue the issue as
"Binary File Download Authentication" on the "Bug-CVS" list.

I'm sorry for any inconvenience this false alarm may have caused
but a prior recent successful breach made it seem prudent to raise
an alarm even though only incomplete information was available.

Best regards,

Conrad T. Pino



_______________________________________________
Info-cvs mailing list
Info-cvs@gnu.org
http://lists.gnu.org/mailman/listinfo/info-cvs
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFB+wUQ0VxxIfjPXe4RAgOlAKChpvI2KwY3LnXyXq0KS6nFxc0UyQCffrRD
DuyL/7wEjq6vvvpajYVlKmY=3D
=3DEgag
=2D----END PGP SIGNATURE-----