Remote code execution, git, and OS X

#1

Post by ingve » Mon, Apr 18, 2016, 5:34 AM UTC

Remote code execution, git, and OS X
rachelbythebay.com

Re: Remote code execution, git, and OS X

#2

Post by reedloden » Mon, Apr 18, 2016, 6:07 AM UTC

Isn't this why projects such as Homebrew thrive? For me personally, I just `brew install git`, and I keep it updated that way (`brew update && brew upgrade`)...

Sure, Apple should ship a fix, but there are ways around it for now.

Re: Remote code execution, git, and OS X

#3

Post by xyzzy123 » Mon, Apr 18, 2016, 6:07 AM UTC

    $ brew install git
    $ git --version
    git version 2.8.1

Re: Remote code execution, git, and OS X

#4

Post by _ZeD_ » Mon, Apr 18, 2016, 6:14 AM UTC

Remember when I said El Capitan?

Apple is doing something new which basically keeps you from twiddling certain system-level programs without going to fantastic lengths.

Not even root is enough to do it.

Can someone explain it to me?

Re: Remote code execution, git, and OS X

#5

Post by mateuszf » Mon, Apr 18, 2016, 6:15 AM UTC

_ZeD_ wrote: post #4

Remember when I said El Capitan? Apple is doing something new which basically keeps you from twiddling certain system-level programs without going to fantastic lengths. Not even root is enough to do it. Can someone explain it to me?

Some parts of the system are write protected. You have to disable that as a root and restart system, then you are allowed to modify these parts.

Re: Remote code execution, git, and OS X

#6

Post by aorth » Mon, Apr 18, 2016, 6:16 AM UTC

reedloden wrote: post #2

Isn't this why projects such as Homebrew thrive? For me personally, I just `brew install git`, and I keep it updated that way (`brew update && brew upgrade`)... Sure, Apple should ship a fix, but there are ways around it for now.

Yes, indeed, but Mac OS X users who use Homebrew are a subset of all Mac OS X users. The problem is in the default software. Apple's update model isn't good for this type of software, so the fact that it is possible for a user to install secure versions from Homebrew (or compile their own) doesn't matter.

Re: Remote code execution, git, and OS X

#7

Post by bndr » Mon, Apr 18, 2016, 6:17 AM UTC

Why the hate for OS X? Fedora 22 and Fedora 23 have only git 2.4.11 and 2.5.5 in their repositories.

Re: Remote code execution, git, and OS X

#8

Post by xyzzy123 » Mon, Apr 18, 2016, 6:18 AM UTC

aorth wrote: post #6

reedloden wrote: post #2

Isn't this why projects such as Homebrew thrive? For me personally, I just `brew install git`, and I keep it updated that way (`brew update && brew upgrade`)... Sure, Apple should ship a fix, but there are ways around it for now.

Yes, indeed, but Mac OS X users who use Homebrew are a subset of all Mac OS X users. The problem is in the default software. Apple's update model isn't good for this type of software, so the fact that it is possible for a user to install secure versions from Homebrew (or compile their own) doesn't matter.

Except that git is used specifically by users who are downloading and compiling software.

Re: Remote code execution, git, and OS X

#9

Post by foota » Mon, Apr 18, 2016, 6:19 AM UTC

bndr wrote: post #7

Why the hate for OS X? Fedora 22 and Fedora 23 have only git 2.4.11 and 2.5.5 in their repositories.

presumably because you can easily update git on Fedora

Re: Remote code execution, git, and OS X

#10

Post by dkopi » Mon, Apr 18, 2016, 6:22 AM UTC

I Clicked on the link expecting to read about a vulnerability. This is actually about blasting OS X for not having updated versions of software.

Software updates are super important of course, and apple should be better at pushing the latest software updates, but I wish the title reflected that.