Executive Summary
Summary | |
---|---|
Title | Git vulnerability |
Informations | |||
---|---|---|---|
Name | USN-2470-1 | First vendor Publication | 2015-01-14 |
Vendor | Ubuntu | Last vendor Modification | 2015-01-14 |
Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : | |||
---|---|---|---|
Cvss Base Score | Not Defined | Attack Range | Not Defined |
Cvss Impact Score | Not Defined | Attack Complexity | Not Defined |
Cvss Expoit Score | Not Defined | Authentication | Not Defined |
Calculate full CVSS 2.0 Vectors scores |
Detail
A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.10 - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS Summary: Git could be made to run programs as your login if it received specially crafted changes from a remote repository. Software Description: - git: fast, scalable, distributed revision control system Details: Matt Mackall and Augie Fackler discovered that Git incorrectly handled certain filesystem paths. A remote attacker could possibly use this issue to execute arbitrary code if the Git tree is stored in an HFS+ or NTFS filesystem. The remote attacker would need write access to a Git repository that the victim pulls from. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 14.10: Ubuntu 14.04 LTS: Ubuntu 12.04 LTS: After a standard system update you need to set the core.protectHFS and/or core.protectNTFS Git configuration variables to "true" if you store Git trees in HFS+ and/or NTFS filesystems. If you host Git trees, setting the core.protectHFS, core.protectNTFS, and receive.fsckObjects Git configuration variables to "true" will cause your Git server to reject objects containing malicious paths intended to overwrite the Git metadata. References: Package Information: |
Original Source
Url : http://www.ubuntu.com/usn/USN-2470-1 |
Alert History
Date | Informations |
---|---|
2015-01-15 13:23:32 |
|
2015-01-14 05:25:09 |
|