Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Git security vulnerability announced

github.blog

Post reply on HN
Print view View original

211–220 of 302 posts

Re: Git security vulnerability announced

#213

Post by hsbauauvhabzb »

megous wrote: post #57
ddworken wrote: post #17

Earlier quoted context omitted.

Though you could have a repository on Github that contains a subdirectory that is a malicious bare Git repo. So doing: ``` git clone github.com/foo/bar cd bar/subdir/ ``` is unsafe with a Git PS1. See https://offensi.com/2019/12/16/4-google-cloud-shell-bugs-exp...

Looks like git complains of invalid paths when you try that.

Just because the cli won’t add doesn’t mean it may not be possible.

Re: Git security vulnerability announced

#214

Post by dataflow »

zarzavat wrote: post #206
db48x wrote: post #100

Earlier quoted context omitted.

It’s one step more indirect than that. If I want my prompt to tell me what branch is checked out, I can have it include the output of running `git branch`, for example. Unbeknownst to me, running `git branch` can cause git to run programs specified in the git repository’s config file. It’s not normally a problem of course, because I am using my own computer with all of my own git repositories. But it can be a problem…

> `git branch` can cause git to run programs specified in the git repository’s config file This is the real vulnerability. Why is git branch running random external programs?

I think `git branch` here wasn't intended to be taken literally. If anything, you'd use a plumbing command to get the branch, not a porcelain command. I think they just meant that some commands that might be run might in turn run programs specified in the config file (either now or in the future).

Re: Git security vulnerability announced

#215

Post by AlbertoAsw10 »

tommiegannert wrote: post #178

> Run the uninstaller under an administrator account rather than as the SYSTEM user How do I run something as SYSTEM? I thought I always ran as "me" or Administrator. Is this only likely to happen for deployment automation tools? > Avoid running the uninstaller until after upgrading Don't leave us with this cliff-hanger... Does the upgrade installer run the uninstaller first? (The original report doesn't have this bu…

af

Re: Git security vulnerability announced

#216

Post by jwilk »

megous wrote: post #57
ddworken wrote: post #17

Earlier quoted context omitted.

Though you could have a repository on Github that contains a subdirectory that is a malicious bare Git repo. So doing: ``` git clone github.com/foo/bar cd bar/subdir/ ``` is unsafe with a Git PS1. See https://offensi.com/2019/12/16/4-google-cloud-shell-bugs-exp...

Looks like git complains of invalid paths when you try that.

What do you mean?

Re: Git security vulnerability announced

#217

Post by Sharparam »

jyrkesh wrote: post #196
asvitkine wrote: post #136

Earlier quoted context omitted.

Can you explain? A shell isn't supposed to be installing things on it's own... (Assuming you're talking about zsh or bash when you say shell.)

There's a lot of different ways to install Git on a lot of different OSes, and some of them put helper shell scripts down by default.

That isn't Git installing things though, that is third-party Git distributions bundling things along with Git.

Re: Git security vulnerability announced

#218

Post by seba_dos1 »

hsbauauvhabzb wrote: post #157
calvinmorrison wrote: post #56

Earlier quoted context omitted.

in other news, access to a users account gives them access to a users account

This is really dismissive. Unexpected execution is not a users fault, and can happen for a variety of reasons (you telling me you’ve never unzipped a full git path someone sent you?)

No? Why would someone zip me a git repo? You can clone/push/pull directly between machines.

Re: Git security vulnerability announced

#219

Post by jve »

saurik wrote: post #185
jve wrote: post #184

Earlier quoted context omitted.

On my Windows 10 machine, I can't access C:\Windows\Temp as unprivileged user. It makes me press Continue, which will invoke admin rights to set privileges for that folder.

That's because you don't have the permission to list the contents of the folder, but you should have permission to create files in it.

True.

  Get-Acl C:\Windows\TEMP | select -ExpandProperty 
 AccessToString
  CREATOR OWNER Allow  268435456
  NT AUTHORITY\SYSTEM Allow  ReadData, Synchronize
  NT AUTHORITY\SYSTEM Allow  268435456
  NT AUTHORITY\SYSTEM Allow  FullControl
  BUILTIN\Administrators Allow  268435456
  BUILTIN\Administrators Allow  FullControl
  BUILTIN\Users Allow  CreateFiles, AppendData, ExecuteFile, Synchronize
  BUILTIN\IIS_IUSRS Allow  ReadData, Synchronize
Post reply on HN