Login
Login-Name Passwort


 
Newsletter
Werbung

Sicherheit: Ausführen beliebiger Kommandos in Git
Aktuelle Meldungen Distributionen
Name: Ausführen beliebiger Kommandos in Git
ID: USN-2470-1
Distribution: Ubuntu
Plattformen: Ubuntu 12.04 LTS, Ubuntu 14.04 LTS, Ubuntu 14.10
Datum: Mi, 14. Januar 2015, 07:31
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9390

Originalnachricht


--===============3276381219836953989==
Content-Type: multipart/signed; micalg=pgp-sha512;
protocol="application/pgp-signature";
boundary="GRPZ8SYKNexpdSJ7"
Content-Disposition: inline


--GRPZ8SYKNexpdSJ7
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

==========================================================================
Ubuntu Security Notice USN-2470-1
January 14, 2015

git vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.10
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS

Summary:

Git could be made to run programs as your login if it received specially
crafted changes from a remote repository.

Software Description:
- git: fast, scalable, distributed revision control system

Details:

Matt Mackall and Augie Fackler discovered that Git incorrectly handled certain
filesystem paths. A remote attacker could possibly use this issue to execute
arbitrary code if the Git tree is stored in an HFS+ or NTFS filesystem. The
remote attacker would need write access to a Git repository that the victim
pulls from.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
git 1:2.1.0-1ubuntu0.1

Ubuntu 14.04 LTS:
git 1:1.9.1-1ubuntu0.1

Ubuntu 12.04 LTS:
git 1:1.7.9.5-1ubuntu0.1

After a standard system update you need to set the core.protectHFS and/or
core.protectNTFS Git configuration variables to "true" if you store Git
trees
in HFS+ and/or NTFS filesystems. If you host Git trees, setting the
core.protectHFS, core.protectNTFS, and receive.fsckObjects Git configuration
variables to "true" will cause your Git server to reject objects
containing
malicious paths intended to overwrite the Git metadata.

References:
http://www.ubuntu.com/usn/usn-2470-1
CVE-2014-9390

Package Information:
https://launchpad.net/ubuntu/+source/git/1:2.1.0-1ubuntu0.1
https://launchpad.net/ubuntu/+source/git/1:1.9.1-1ubuntu0.1
https://launchpad.net/ubuntu/+source/git/1:1.7.9.5-1ubuntu0.1


--GRPZ8SYKNexpdSJ7
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJUtby3AAoJENaSAD2qAscKb/cP/igiQaDGCMzmIdugDvAZfWID
1v/oFTMLqkzkqD/YDq0plryXuBSs1B73hpPcscKrjRHnbMHQQn1Wk2gmtxd/IbGz
ljpeKHZPbYd+dR8+FKvdxfCsGO5eDCOhhgsO4SfWR5UmxrWRpFlcmN7p21RobngV
EmXii//8gJtPyRA4DfJ5FiWP0DTo3tZ2hsQNsJblJd/dn0e0FMzuDRUS5exzphcd
8MjBjH4P47ahYV4QULa+gdvhlCme5bXTXCWUUnMvrKERwIALQjFZ9EK236fQnpjQ
X/Wx1Xh8tPvJ2XAl2h+3jAmFp1T0D0Q9WIGUgFdRaTDNRqSCLf1Act0DyuMK/210
7gq6DknumPgcdU/S1by7LH9LB89MVGNVg2bLTieLSXnzPLt0+qHubgH82W/dgHuM
IBQKmIBSVxJff8TjfndQPs7vfesGEKsuyoEiq69gBbfvj9UsYrg7hJ4r8qe6b0R0
woa+G0QsV83Rzs6x4/Rg07uqy3brjgvVQOD8jceNt1S8VJft4mLX7erez2rNX354
6HlFmcF3LuRfUmB5i+JqZRDYEZdI29M5eYKGhcXOrz45qt3Ck9+bo9no48fjl6gG
IGAPAGUtFQeHsb0tB4k/lDKA8rPUJ1PYOUIkP4Ya3VOlKK3Hfxmj48yPKHgiaHni
lya0auP9MSh2iJ7ifMhl
=FQQB
-----END PGP SIGNATURE-----

--GRPZ8SYKNexpdSJ7--


--===============3276381219836953989==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

--===============3276381219836953989==--
Pro-Linux
Traut euch!
Neue Nachrichten
Werbung