4.6 - CVE-2008-5916

Executive Summary

Informations
Name	CVE-2008-5916	First vendor Publication	2009-01-20
Vendor	Cve	Last vendor Modification	2024-11-21

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score	4.6	Attack Range	Local
Cvss Impact Score	6.4	Attack Complexity	Low
Cvss Expoit Score	3.9	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

gitweb/gitweb.perl in gitweb in Git 1.6.x before 1.6.0.6, 1.5.6.x before 1.5.6.6, 1.5.5.x before 1.5.5.6, 1.5.4.x before 1.5.4.7, and other versions after 1.4.3 allows local repository owners to execute arbitrary commands by modifying the diff.external configuration variable and executing a crafted gitweb query.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5916

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-264	Permissions, Privileges, and Access Controls

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:12780

Oval ID:	oval:org.mitre.oval:def:12780
Title:	DSA-1708-1 git-core -- shell command injection
Description:	It was discovered that gitweb, the web interface for the Git version control system, contained several vulnerabilities: Remote attackers could use crafted requests to execute shell commands on the web server, using the snapshot generation and pickaxe search functionality. Local users with write access to the configuration of a Git repository served by gitweb could cause gitweb to execute arbitrary shell commands with the permission of the web server. For the stable distribution, these problems have been fixed in version 1:1.4.4.4-4+etch1. For the unstable distribution and testing distribution, the remote shell command injection issuei has been fixed in version 1.5.6-1. The other issue will be fixed soon. We recommend that you upgrade your Git packages.
Family:	unix	Class:	patch
Reference(s):	DSA-1708-1 CVE-2008-5516 CVE-2008-5517 CVE-2008-5916	Version:	7
Platform(s):	Debian GNU/Linux 4.0	Product(s):	git-core
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. Architecture section Architecture independent section Installed architecture is all AND Packages section git-daemon-run DPKG is earlier than 1:1.4.4.4-4+etch1 AND gitweb DPKG is earlier than 1:1.4.4.4-4+etch1 AND git-doc DPKG is earlier than 1:1.4.4.4-4+etch1 AND git-svn DPKG is earlier than 1:1.4.4.4-4+etch1 AND git-arch DPKG is earlier than 1:1.4.4.4-4+etch1 AND git-cvs DPKG is earlier than 1:1.4.4.4-4+etch1 AND git-email DPKG is earlier than 1:1.4.4.4-4+etch1 AND gitk DPKG is earlier than 1:1.4.4.4-4+etch1 AND git-core DPKG is earlier than 1:1.4.4.4-4+etch1

Definition Id: oval:org.mitre.oval:def:13916

Oval ID:	oval:org.mitre.oval:def:13916
Title:	USN-723-1 -- git-core vulnerabilities
Description:	It was discovered that Git did not properly handle long file paths. If a user were tricked into performing commands on a specially crafted Git repository, an attacker could possibly execute arbitrary code with the privileges of the user invoking the program. It was discovered that the Git web interface did not correctly handle shell metacharacters when processing certain commands. A remote attacker could send specially crafted commands to the Git server and execute arbitrary code with the privileges of the Git web server. This issue only applied to Ubuntu 7.10 and 8.04 LTS. It was discovered that the Git web interface did not properly restrict the diff.external configuration parameter. A local attacker could exploit this issue and execute arbitrary code with the privileges of the Git web server. This issue only applied to Ubuntu 8.04 LTS and 8.10
Family:	unix	Class:	patch
Reference(s):	USN-723-1 CVE-2008-3546 CVE-2008-5516 CVE-2008-5517 CVE-2008-5916	Version:	5
Platform(s):	Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10	Product(s):	git-core
Definition Synopsis:
Release section Ubuntu 7.10 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section git-gui DPKG is earlier than 1:1.5.2.5-2ubuntu0.1 AND git-daemon-run DPKG is earlier than 1:1.5.2.5-2ubuntu0.1 AND gitweb DPKG is earlier than 1:1.5.2.5-2ubuntu0.1 AND git-doc DPKG is earlier than 1:1.5.2.5-2ubuntu0.1 AND git-p4 DPKG is earlier than 1:1.5.2.5-2ubuntu0.1 AND git-arch DPKG is earlier than 1:1.5.2.5-2ubuntu0.1 AND git-cvs DPKG is earlier than 1:1.5.2.5-2ubuntu0.1 AND git-svn DPKG is earlier than 1:1.5.2.5-2ubuntu0.1 AND git-email DPKG is earlier than 1:1.5.2.5-2ubuntu0.1 AND gitk DPKG is earlier than 1:1.5.2.5-2ubuntu0.1 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND git-core DPKG is earlier than 1:1.5.2.5-2ubuntu0.1 OR Release section Ubuntu 8.04 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section git-gui DPKG is earlier than 1:1.5.4.3-1ubuntu2.1 AND git-daemon-run DPKG is earlier than 1:1.5.4.3-1ubuntu2.1 AND gitweb DPKG is earlier than 1:1.5.4.3-1ubuntu2.1 AND git-doc DPKG is earlier than 1:1.5.4.3-1ubuntu2.1 AND git-svn DPKG is earlier than 1:1.5.4.3-1ubuntu2.1 AND git-arch DPKG is earlier than 1:1.5.4.3-1ubuntu2.1 AND git-cvs DPKG is earlier than 1:1.5.4.3-1ubuntu2.1 AND git-email DPKG is earlier than 1:1.5.4.3-1ubuntu2.1 AND gitk DPKG is earlier than 1:1.5.4.3-1ubuntu2.1 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND git-core DPKG is earlier than 1:1.5.4.3-1ubuntu2.1 OR Release section Ubuntu 6.06 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section git-doc DPKG is earlier than 1.1.3-1ubuntu1.1 AND git-svn DPKG is earlier than 1.1.3-1ubuntu1.1 AND git-arch DPKG is earlier than 1.1.3-1ubuntu1.1 AND git-cvs DPKG is earlier than 1.1.3-1ubuntu1.1 AND git-email DPKG is earlier than 1.1.3-1ubuntu1.1 AND gitk DPKG is earlier than 1.1.3-1ubuntu1.1 OR Architecture depended section Supported architectures section Installed architecture is sparc AND Installed architecture is powerpc AND Installed architecture is amd64 AND Installed architecture is i386 AND git-core DPKG is earlier than 1.1.3-1ubuntu1.1 OR Release section Ubuntu 8.10 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section git-gui DPKG is earlier than 1:1.5.6.3-1.1ubuntu2.1 AND git-daemon-run DPKG is earlier than 1:1.5.6.3-1.1ubuntu2.1 AND gitweb DPKG is earlier than 1:1.5.6.3-1.1ubuntu2.1 AND git-doc DPKG is earlier than 1:1.5.6.3-1.1ubuntu2.1 AND git-svn DPKG is earlier than 1:1.5.6.3-1.1ubuntu2.1 AND git-arch DPKG is earlier than 1:1.5.6.3-1.1ubuntu2.1 AND git-cvs DPKG is earlier than 1:1.5.6.3-1.1ubuntu2.1 AND git-email DPKG is earlier than 1:1.5.6.3-1.1ubuntu2.1 AND gitk DPKG is earlier than 1:1.5.6.3-1.1ubuntu2.1 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND git-core DPKG is earlier than 1:1.5.6.3-1.1ubuntu2.1

Definition Id: oval:org.mitre.oval:def:7699

Oval ID:	oval:org.mitre.oval:def:7699
Title:	DSA-1708 git-core -- shell command injection
Description:	It was discovered that gitweb, the web interface for the Git version control system, contained several vulnerabilities: Remote attackers could use crafted requests to execute shell commands on the web server, using the snapshot generation and pickaxe search functionality (CVE-2008-5916). Local users with write access to the configuration of a Git repository served by gitweb could cause gitweb to execute arbitrary shell commands with the permission of the web server (CVE-2008-5516, CVE-2008-5517).
Family:	unix	Class:	patch
Reference(s):	DSA-1708 CVE-2008-5516 CVE-2008-5517 CVE-2008-5916	Version:	5
Platform(s):	Debian GNU/Linux 4.0	Product(s):	git-core
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. Architecture section Architecture independent section Installed architecture is all AND Packages section gitweb is earlier than 1:1.4.4.4-4+etch1 AND git-arch is earlier than 1:1.4.4.4-4+etch1 AND gitk is earlier than 1:1.4.4.4-4+etch1 AND git-daemon-run is earlier than 1:1.4.4.4-4+etch1 AND git-doc is earlier than 1:1.4.4.4-4+etch1 AND git-svn is earlier than 1:1.4.4.4-4+etch1 AND git-cvs is earlier than 1:1.4.4.4-4+etch1 AND git-email is earlier than 1:1.4.4.4-4+etch1 AND git-core is earlier than 1:1.4.4.4-4+etch1

CPE : Common Platform Enumeration

Type	Description	Count
Application	Git cpe:2.3:a:git:git:1.6.0.5:::::::* cpe:2.3:a:git:git:1.6.0.4:::::::* cpe:2.3:a:git:git:1.6.0.3:::::::* cpe:2.3:a:git:git:1.6.0.2:::::::* cpe:2.3:a:git:git:1.6.0.1:::::::* cpe:2.3:a:git:git:1.6.0:::::::* cpe:2.3:a:git:git:1.6.0:rc3:::::: cpe:2.3:a:git:git:1.6.0:rc2:::::: cpe:2.3:a:git:git:1.6.0:rc1:::::: cpe:2.3:a:git:git:1.5.6.5:::::::* cpe:2.3:a:git:git:1.5.6.4:::::::* cpe:2.3:a:git:git:1.5.6.3:::::::* cpe:2.3:a:git:git:1.5.6.2:::::::* cpe:2.3:a:git:git:1.5.6.1:::::::* cpe:2.3:a:git:git:1.5.6:::::::* cpe:2.3:a:git:git:1.5.5.5:::::::* cpe:2.3:a:git:git:1.5.5.4:::::::* cpe:2.3:a:git:git:1.5.5.3:r1:::::: cpe:2.3:a:git:git:1.5.5.3:::::::* cpe:2.3:a:git:git:1.5.5.2:::::::* cpe:2.3:a:git:git:1.5.5.1:::::::* cpe:2.3:a:git:git:1.5.5:rc3:::::: cpe:2.3:a:git:git:1.5.5:rc2:::::: cpe:2.3:a:git:git:1.5.5:::::::* cpe:2.3:a:git:git:1.5.5:rc1:::::: cpe:2.3:a:git:git:1.5.4.6:::::::* cpe:2.3:a:git:git:1.5.4.5:::::::* cpe:2.3:a:git:git:1.5.4.4:::::::* cpe:2.3:a:git:git:1.5.4.3:::::::* cpe:2.3:a:git:git:1.5.4.2:::::::* cpe:2.3:a:git:git:1.5.4.1:::::::* cpe:2.3:a:git:git:1.5.4:rc0:::::: cpe:2.3:a:git:git:1.5.4:::::::* cpe:2.3:a:git:git:1.5.4:rc4:::::: cpe:2.3:a:git:git:1.5.4:rc5:::::: cpe:2.3:a:git:git:1.5.4:rc2:::::: cpe:2.3:a:git:git:1.5.4:rc1:::::: cpe:2.3:a:git:git:1.5.4:rc1.1136.g2794:::::: cpe:2.3:a:git:git:1.5.4:rc3:::::: cpe:2.3:a:git:git:1.5.3.8:::::::* cpe:2.3:a:git:git:1.5.3.7:::::::* cpe:2.3:a:git:git:1.5.3.6:::::::* cpe:2.3:a:git:git:1.5.3.5:::::::* cpe:2.3:a:git:git:1.5.3.4:::::::* cpe:2.3:a:git:git:1.5.3.3:::::::* cpe:2.3:a:git:git:1.5.3.2:::::::* cpe:2.3:a:git:git:1.5.3.1:::::::* cpe:2.3:a:git:git:1.5.3:rc7:::::: cpe:2.3:a:git:git:1.5.3:::::::* cpe:2.3:a:git:git:1.5.3:rc5:::::: cpe:2.3:a:git:git:1.5.3:rc4:::::: cpe:2.3:a:git:git:1.5.2.5:::::::* cpe:2.3:a:git:git:1.5.2.4:::::::* cpe:2.3:a:git:git:1.5.2.3:::::::* cpe:2.3:a:git:git:1.5.2.2:::::::* cpe:2.3:a:git:git:1.5.2.1:::::::* cpe:2.3:a:git:git:1.5.2:::::::* cpe:2.3:a:git:git:1.5.1.6:::::::* cpe:2.3:a:git:git:1.5.1.5:::::::* cpe:2.3:a:git:git:1.5.1.4:::::::* cpe:2.3:a:git:git:1.5.1.3:::::::* cpe:2.3:a:git:git:1.5.1.2:::::::* cpe:2.3:a:git:git:1.5.1.1:::::::* cpe:2.3:a:git:git:1.5.1:::::::* cpe:2.3:a:git:git:1.5.0.7:::::::* cpe:2.3:a:git:git:1.5.0.6:::::::* cpe:2.3:a:git:git:1.5.0.5:::::::* cpe:2.3:a:git:git:1.5.0.4:::::::* cpe:2.3:a:git:git:1.5.0.3:::::::* cpe:2.3:a:git:git:1.5.0.2:::::::* cpe:2.3:a:git:git:1.5.0.1:::::::* cpe:2.3:a:git:git:1.5.0:rc3:::::: cpe:2.3:a:git:git:1.5.0:rc4:::::: cpe:2.3:a:git:git:1.5.0:rc2:::::: cpe:2.3:a:git:git:1.5.0:::::::* cpe:2.3:a:git:git:1.4.4.4:::::::* cpe:2.3:a:git:git:1.4.4.3:::::::* cpe:2.3:a:git:git:1.4.4.2:::::::* cpe:2.3:a:git:git:1.4.4.1:::::::* cpe:2.3:a:git:git:1.4.4:::::::* cpe:2.3:a:git:git:1.4.3.5:::::::* cpe:2.3:a:git:git:1.4.3.4:::::::* cpe:2.3:a:git:git:1.4.3.3:::::::* cpe:2.3:a:git:git:1.4.3.2:::::::* cpe:2.3:a:git:git:1.4.3.1:::::::*	85

OpenVAS Exploits

Date	Description
2009-06-05	Name : Ubuntu USN-723-1 (git-core) File : nvt/ubuntu_723_1.nasl
2009-03-13	Name : Gentoo Security Advisory GLSA 200903-15 (git) File : nvt/glsa_200903_15.nasl
2009-02-13	Name : Fedora Update for git FEDORA-2008-11650 File : nvt/gb_fedora_2008_11650_git_fc9.nasl
2009-02-13	Name : Fedora Update for git FEDORA-2008-11653 File : nvt/gb_fedora_2008_11653_git_fc8.nasl
2009-01-20	Name : FreeBSD Ports: git File : nvt/freebsd_git.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
50918	GIT gitweb/gitweb.perl diff.external Configuration Variable Crafted Query Loc...

Nessus® Vulnerability Scanner

Date	Description
2009-04-23	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-723-1.nasl - Type : ACT_GATHER_INFO
2009-03-10	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200903-15.nasl - Type : ACT_GATHER_INFO
2009-01-20	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1708.nasl - Type : ACT_GATHER_INFO
2008-12-22	Name : The remote Fedora host is missing a security update. File : fedora_2008-11650.nasl - Type : ACT_GATHER_INFO
2008-12-22	Name : The remote Fedora host is missing a security update. File : fedora_2008-11653.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

http://marc.info/?l=git&m=122975564100860&w=2
http://marc.info/?l=linux-kernel&m=122975564100863&w=2:
http://osvdb.org/50918
http://secunia.com/advisories/33282
http://secunia.com/advisories/33964
http://secunia.com/advisories/34194
http://securityreason.com/securityalert/4922
http://www.gentoo.org/security/en/glsa/glsa-200903-15.xml
http://www.openwall.com/lists/oss-security/2009/01/15/2
http://www.openwall.com/lists/oss-security/2009/01/20/2
http://www.ubuntu.com/usn/USN-723-1
https://exchange.xforce.ibmcloud.com/vulnerabilities/47528
https://www.redhat.com/archives/fedora-package-announce/2008-December/msg0116...
https://www.redhat.com/archives/fedora-package-announce/2008-December/msg0117...

Source	Url

Alert History

If you want to see full details history, please login or register.

Date	Informations
2024-11-28 23:12:28	Multiple Updates
2024-11-28 12:17:26	Multiple Updates
2021-05-04 12:08:38	Multiple Updates
2021-04-22 01:08:59	Multiple Updates
2020-05-23 00:22:50	Multiple Updates
2017-08-08 09:24:37	Multiple Updates
2016-06-28 17:24:10	Multiple Updates
2016-04-26 18:12:58	Multiple Updates
2014-02-17 10:47:51	Multiple Updates
2013-05-11 00:34:12	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	3
CPE ID(s)	85
Sources(s)	14
osvdb(s)	1
Openvas Exploit(s)	5
Nessus® Exploit(s)	5

	Related
7.5	USN-723-1
7.5	GLSA-200903-15
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 2 more Alert(s)

4.6 - CVE-2008-5916

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

CWE : Common Weakness Enumeration

OVAL Definitions

CPE : Common Platform Enumeration

OpenVAS Exploits

Open Source Vulnerability Database (OSVDB)

Nessus® Vulnerability Scanner

Sources (Detail)

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU