It's really a moot point as this was AND still is a common problem no matter the OS. I fail to see any releases of any OS that's secure out of the box.
Vulnerable git ships with Xcode, not OS X "out of the box".
(What point is moot?)
Remote code execution, git, and OS X
51–60 of 385 posts
Re: Remote code execution, git, and OS X
#52If you execute csrutil disable && reboot, you will be able to disable System Integrity protection and do what you want including fixing /usr/bin/git. What is the problem?
You need to do that from the Recovery OS, by the way.
Re: Remote code execution, git, and OS X
#53Isn't this why projects such as Homebrew thrive? For me personally, I just `brew install git`, and I keep it updated that way (`brew update && brew upgrade`)... Sure, Apple should ship a fix, but there are ways around it for now.
Sure, but your /usr/bin/git is still vulnerable. You're one config mistake (or maybe running a "malicious" script) away from executing.
Sure, as many other software with vulnerability, but with local software like brew (I wrote also [dotsoftware](http://g14n.info/dotsoftware) for the same reasons) you don't have it in your PATH so you are not using it.
Using local software has many benefits, among others, a shorter release cycle.
Re: Remote code execution, git, and OS X
#54I Clicked on the link expecting to read about a vulnerability. This is actually about blasting OS X for not having updated versions of software. Software updates are super important of course, and apple should be better at pushing the latest software updates, but I wish the title reflected that.
> This is actually about blasting OS X for not having updated versions of software. No it's not, it's blasting OS X for shipping software with a known remote execution vulnerability, and not allowing the user to easily upgrade that software themselves due to new OS-wide security policies.
Good point. I stand corrected.
Re: Remote code execution, git, and OS X
#55I Clicked on the link expecting to read about a vulnerability. This is actually about blasting OS X for not having updated versions of software. Software updates are super important of course, and apple should be better at pushing the latest software updates, but I wish the title reflected that.
> This is actually about blasting OS X for not having updated versions of software. No it's not, it's blasting OS X for shipping software with a known remote execution vulnerability, and not allowing the user to easily upgrade that software themselves due to new OS-wide security policies.
>and not allowing the user to easily upgrade that software themselves due to new OS-wide security policies.
But the author didn't try that. They merely speculated that
upgrading over top of that will almost certainly screw something up later.
I upgraded the Subversion that's shipped with XCode 5 on OS X 10.9 (both old, I know) without any problems simply by manually replacing the files in /Applications/XCode.app/Contents/Developer/usr/bin.
Re: Remote code execution, git, and OS X
#56Why the hate for OS X? Fedora 22 and Fedora 23 have only git 2.4.11 and 2.5.5 in their repositories.
Debian stable is still on 2.1. https://packages.debian.org/jessie/git ~ git --version git version 2.1.4
Security fixes were cherry picked... http://metadata.ftp-master.debian.org/changelogs//main/g/git...
Re: Remote code execution, git, and OS X
#57Why the hate for OS X? Fedora 22 and Fedora 23 have only git 2.4.11 and 2.5.5 in their repositories.
Debian stable is still on 2.1. https://packages.debian.org/jessie/git ~ git --version git version 2.1.4
Re: Remote code execution, git, and OS X
#58Earlier quoted context omitted.
presumably because you can easily update git on Fedora
When I do `dnf update git` I get at most 2.4.11/2.5.5, the only way I can get the latest is to compile from source. EDIT: OK. So the fixes were backported
From what it sounded like in the article though you can't even easily replace the OSX binary for git, even if you compile it yourself.
Re: Remote code execution, git, and OS X
#59Earlier quoted context omitted.
Debian stable is still on 2.1. https://packages.debian.org/jessie/git ~ git --version git version 2.1.4
Security fixes were cherry picked... http://metadata.ftp-master.debian.org/changelogs//main/g/git...
Ah ok. Well I just updated to 2.8 on testing. I have only recently begun to read the Debian security mailing list.
Re: Remote code execution, git, and OS X
#60I have my git repo on debian stable and
git --version
git version 2.1.4