Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote code execution, git, and OS X

rachelbythebay.com

Post reply on HN
Print view View original

121–130 of 385 posts

Re: Remote code execution, git, and OS X

#121

Post by developer2 »

dchest wrote: post #35
jaequery wrote: post #28

Earlier quoted context omitted.

I'm pretty sure git isn't the only thing that is (or will be) vulnerable. Vulnerabilities happen, it's a fact of life. You will have to constantly update your systems no matter which OS you run.

Did you read the linked article?

Yes we did, and the author appears to be posting with the primary intent of spreading anti-Apple sentiments. The opening paragraph begins by insulting startups for being full of Macs. The rest of the post is full of snide comments. They go off on a tangent about System Integrity Protection and the fact that OS X is not Linux ("Apple... keeps you from twiddling", "Well, sorry. You also can't chmod", "I'll just strace it to see what it execs! Oh wait, this isn't Linux."). This could easily have been posted as a simple statement of the CVEs in question and the version of git shipped with latest OS X patch. Not difficult to post facts about a specific issue without insulting an entire operating system - and taking cheap shots at the people that use it.

>> If you rely on machines like this, I am truly sorry. I feel for you.

I don't feel sorry for myself. Odd that a stranger finds it necessary to offer me their sympathy, let alone condescending pity.

Re: Remote code execution, git, and OS X

#122

Post by bestest »

paradite wrote: post #25
xyzzy123 wrote: post #3

$ brew install git $ git --version git version 2.8.1

Weird, I got git 2.6.1 using the same command: $ brew install git ==> Downloading https://homebrew.bintray.com/bottles/git-2.6.1.el_capitan.bo... $ git version git version 2.6.1 $ brew upgrade git Error: git 2.6.1 already installed

Now refresh the current shell or open a new terminal window, and try git --version once again. Version should be good.

Reason for this being old shell environment not being aware that you updated the environment path.

Re: Remote code execution, git, and OS X

#123

Post by chris_wot »

anu_gupta wrote: post #115
chris_wot wrote: post #104

Earlier quoted context omitted.

It looks like I need to reboot my machine just to disable it. That's the only info I can see to turn it off - unless I'm missing something?

So reboot your machine and disable it if you want. Aren't you able to do that for some reason?

Not if I want to update system software for some reason and I'm running a server.

Re: Remote code execution, git, and OS X

#124

Post by gpvos »

atdt wrote: post #46
brightball wrote: post #15

Earlier quoted context omitted.

And at this point the first instruction for any OSX user who downloads and compiles anything is "Install Homebrew"

The Homebrew installation process uses the system git.

Can you inunstall XCode again once you have installed a compiler, toolchain, and git via Homebrew?

Re: Remote code execution, git, and OS X

#125

Post by chris_wot »

comex wrote: post #114
chris_wot wrote: post #104

Earlier quoted context omitted.

It looks like I need to reboot my machine just to disable it. That's the only info I can see to turn it off - unless I'm missing something?

Yes. This is by design, since the whole point is to defend against malware that has gotten root privileges; requiring recovery mode ensures that the physical user of the computer consents to the change.

Wow, my innocent question seems to have pissed off a few people!

Anyway, so only system updates can update the OS X system? Which involves a system reboot? How does the "system protected" software get updated?

But not making it easy to update flawed software sounds like a great vector for malware.

Re: Remote code execution, git, and OS X

#126

Post by chris_wot »

comex wrote: post #112
chris_wot wrote: post #95

Earlier quoted context omitted.

You're joking, right? When I use software and I look at the version number, I like to know that it is what it says it is. If they are going to patch the vulnerability, then I want to know if they have done so. Besides which, this whole question is missing the point somewhat. There is no easy way of updating the system supplied tools like git, even if you wanted to. The latest version of git is v2.8, and I think it wo…

Inability to manually update the copy of a tool located in /usr is par for the course with most Linux distributions - in that case the kernel won't stop you from replacing the files (unless your distro has the root FS mounted RO), but the package manager will typically replace them right back the next time there's a minor update (same for OS X updates pre-SIP), and it's easy to accidentally break things. Instead, the…

Right, if its so easy then why don't Apple update git more frequently then?

Re: Remote code execution, git, and OS X

#127

Post by atdt »

comex wrote: post #102
atdt wrote: post #78

Earlier quoted context omitted.

The problem is that System Integrity protection was put in place for my benefit and marketed to me as a feature that had been "designed to help prevent potentially malicious software from modifying protected files and folders on [my] Mac", and now that I have it and paid money for it (or the Apple hardware it runs on), I find out that it is making me less secure by preventing me from removing a software component whi…

Yes. (a) You are not a typical user; (b) disabling SIP takes five minutes plus whatever productivity loss is caused by rebooting; (c) it isn't actually necessary to disable SIP to make git inaccessible, as described later in the post; (d) even if it were, you would get most of the protection by just installing your own git in a different location and changing PATH; and (e) the vulnerability in question is incredibly…

It is not necessary to run anything except "git clone". An attacker can construct a repository such that merely attempting to clone it would execute arbitrary code. This is why the vulnerability was given a CVSS base severity score of 9.8 (out of a possible 10).

Re: Remote code execution, git, and OS X

#128

Post by anu_gupta »

chris_wot wrote: post #123
anu_gupta wrote: post #115

Earlier quoted context omitted.

So reboot your machine and disable it if you want. Aren't you able to do that for some reason?

Not if I want to update system software for some reason and I'm running a server.

So you install development tools like XCode on a server?

Re: Remote code execution, git, and OS X

#129

Post by comex »

chris_wot wrote: post #125
comex wrote: post #114

Earlier quoted context omitted.

Yes. This is by design, since the whole point is to defend against malware that has gotten root privileges; requiring recovery mode ensures that the physical user of the computer consents to the change.

Wow, my innocent question seems to have pissed off a few people! Anyway, so only system updates can update the OS X system? Which involves a system reboot? How does the "system protected" software get updated? But not making it easy to update flawed software sounds like a great vector for malware.

Sorry if I came across that way myself. As for updates - I'm not sure; I should figure that out when I have the chance.

Re: Remote code execution, git, and OS X

#130

Post by scottydelta »

jnardiello wrote: post #18

I might be wrong here, but using brew will NOT remove git shipped with xcode, so you are still vulnerable.

yes, that is why you set path variable in your bash_profile so that when you do 'which git', you are not pointed to /usr/bin/git but /usr/local/bin/git. you might also want to do sudo chmod a-x to /usr/bin/git.
Post reply on HN