Git client vulnerability announced • Hacker News Board

Re: Git client vulnerability announced

#61

Post by [deleted] » Thu, Dec 18, 2014, 10:39 PM UTC

e40 wrote: post #60

FiloSottile wrote: post #5

Short panic summary: your git/hg remotes can get code execution on your machine when you clone/pull if you are on OSX or Windows. Summary: on case-insensitive/normalizing filesystems (default on OSX and Windows) it's possible for .git/config to be overwritten by the tree, probably due to a case-sensitive sanity check when the actual file is insensitive. .git/config can contain arbitrary commands to be run on certain…

Cygwin and Macports both have versions which are vulnerable. EDIT: Macports just updated. I did it with # port selfupdate # port upgrade outdated and 2.2.1 came down. If you have the Apple git, then you should # port install git

[deleted]

Re: Git client vulnerability announced

#62

Post by numlocked » Thu, Dec 18, 2014, 10:40 PM UTC

jazzychad wrote: post #47

If you don't want to use homebrew on mac, here is the list of commands I used to upgrade: https://gist.github.com/jazzychad/07c0c6da5709202e8106

This was very helpful and clearly documented. Thanks!

Also, your github profile picture is amazing.

Re: Git client vulnerability announced

#63

Post by [deleted] » Thu, Dec 18, 2014, 10:43 PM UTC

fizzbatter wrote: post #59

tptacek wrote: post #9

Earlier quoted context omitted.

Lose the /or. Update no matter what.

Well, to be clear, this only affects Mac and Windows, correct? (Technically any case changing os) So, update no matter what, unless you're not on an affected system? (this is a question, not a statement)

[deleted]

Re: Git client vulnerability announced

#64

Post by comex » Thu, Dec 18, 2014, 10:43 PM UTC

peff wrote: post #19

califield wrote: post #14

Earlier quoted context omitted.

Yeah, but typically you have a certain level of trust in your project dependencies. Adding a library to your project often means granting access to your system anyway (if the dependency contains executable code).

You were and are vulnerable to malicious projects by running: git clone git://... make or anything similar, since you are running arbitrary code out of the repository. This release fixes the problem of: git clone git://... git show etc. Git cannot fix the "clone and run" problem, which is a social one. But it should be safe to run git commands to inspect the repository contents.

I don't think the GP should be downvoted. What you say is exactly correct - however - I can't even think of a time I've git cloned some piece of code and not proceeded to run some code from it at some point, typically on the same machine. I download code for the purpose of using it, and while I could hypothetically inspect the entire repository for malicious code, I don't think I'm unusual in not doing that on a regular basis.

I guess maybe Docker/Vagrant/etc. users don't normally run code directly on their development machine, so it can be high priority for them. But as someone who doesn't use these tools (not a web developer), for me the vulnerability is extremely low priority.

Re: Git client vulnerability announced

#65

Post by yincrash » Thu, Dec 18, 2014, 10:43 PM UTC

FiloSottile wrote: post #5

Short panic summary: your git/hg remotes can get code execution on your machine when you clone/pull if you are on OSX or Windows. Summary: on case-insensitive/normalizing filesystems (default on OSX and Windows) it's possible for .git/config to be overwritten by the tree, probably due to a case-sensitive sanity check when the actual file is insensitive. .git/config can contain arbitrary commands to be run on certain…

Yes, the actual vulnerability is that you can commit .Git/config or .gIt/config etc., and on case insensitive filesystem, checking that out will overwrite .git/config.

Re: Git client vulnerability announced

#66

Post by jszymborski » Thu, Dec 18, 2014, 10:46 PM UTC

Anybody have an idea when SourceTree will have an update?

Re: Git client vulnerability announced

#67

Post by keeperofdakeys » Thu, Dec 18, 2014, 10:50 PM UTC

fizzbatter wrote: post #59

tptacek wrote: post #9

Earlier quoted context omitted.

Lose the /or. Update no matter what.

Well, to be clear, this only affects Mac and Windows, correct? (Technically any case changing os) So, update no matter what, unless you're not on an affected system? (this is a question, not a statement)

As mentioned in the mailing list announcement (http://article.gmane.org/gmane.linux.kernel/1853266), if you run a git host on linux, you can still spread the dangerous commit.

Re: Git client vulnerability announced

#68

Post by [deleted] » Thu, Dec 18, 2014, 10:51 PM UTC

fizzbatter wrote: post #59

tptacek wrote: post #9

Earlier quoted context omitted.

Lose the /or. Update no matter what.

Well, to be clear, this only affects Mac and Windows, correct? (Technically any case changing os) So, update no matter what, unless you're not on an affected system? (this is a question, not a statement)

[deleted]

Re: Git client vulnerability announced

#69

Post by iamdave » Thu, Dec 18, 2014, 10:53 PM UTC

jazzychad wrote: post #47

If you don't want to use homebrew on mac, here is the list of commands I used to upgrade: https://gist.github.com/jazzychad/07c0c6da5709202e8106

Beautiful, cheers for this!

Re: Git client vulnerability announced

#70

Post by sp332 » Thu, Dec 18, 2014, 10:55 PM UTC

fizzbatter wrote: post #59

tptacek wrote: post #9

Earlier quoted context omitted.

Lose the /or. Update no matter what.

Well, to be clear, this only affects Mac and Windows, correct? (Technically any case changing os) So, update no matter what, unless you're not on an affected system? (this is a question, not a statement)

Or Linux mounting a case-insensitive share, e.g. CIFS.