- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200903-15 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: git: Multiple vulnerabilties Date: March 09, 2009 Bugs: #251343 ID: 200903-15 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities in gitweb allow for remote execution of arbitrary commands. Background ========== GIT - the stupid content tracker, the revision control system used by the Linux kernel team. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-util/git < 1.6.0.6 >= 1.6.0.6 Description =========== Multiple vulnerabilities have been reported in gitweb that is part of the git package: * Shell metacharacters related to git_search are not properly sanitized (CVE-2008-5516). * Shell metacharacters related to git_snapshot and git_object are not properly sanitized (CVE-2008-5517). * The diff.external configuration variable as set in a repository can be executed by gitweb (CVE-2008-5916). Impact ====== A remote unauthenticated attacker can execute arbitrary commands via shell metacharacters in a query, remote attackers with write access to a git repository configuration can execute arbitrary commands with the privileges of the user running gitweb by modifying the diff.external configuration variable in the repository and sending a crafted query to gitweb. Workaround ========== There is no known workaround at this time. Resolution ========== All git users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-util/git-1.6.0.6" References ========== [ 1 ] CVE-2008-5516 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5516 [ 2 ] CVE-2008-5517 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5517 [ 3 ] CVE-2008-5916 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5916 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200903-15.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@xxxxxxxxxx or alternatively, you may file a bug at http://bugs.gentoo.org. License ======= Copyright 2009 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5
Attachment:
signature.asc
Description: This is a digitally signed message part.