Remote code execution, git, and OS X • Hacker News Board

Re: Remote code execution, git, and OS X

#41

Post by dchest » Mon, Apr 18, 2016, 6:51 AM UTC

yelnatz wrote: post #38

dchest wrote: post #34

Earlier quoted context omitted.

This is in the linked post. Do this to disable it: sudo chmod -x /Applications/Xcode.app/Contents/Developer/usr/bin/git

chmod: /Applications/Xcode.app/Contents/Developer/usr/bin/git: No such file or directory I don't have Xcode installed, do I have to install it back to do this?

No, vulnerable git ships with Xcode.

Re: Remote code execution, git, and OS X

#42

Post by madeofpalk » Mon, Apr 18, 2016, 6:54 AM UTC

yelnatz wrote: post #38

dchest wrote: post #34

Earlier quoted context omitted.

This is in the linked post. Do this to disable it: sudo chmod -x /Applications/Xcode.app/Contents/Developer/usr/bin/git

chmod: /Applications/Xcode.app/Contents/Developer/usr/bin/git: No such file or directory I don't have Xcode installed, do I have to install it back to do this?

If you don't have Xcode installed then you don't have git.

IIRC, you might have a /usr/bin/git executable but that's not actually git, all it does is shows a GUI that prompts you to install XCode

Re: Remote code execution, git, and OS X

#43

Post by mukundmr » Mon, Apr 18, 2016, 6:55 AM UTC

If you execute csrutil disable && reboot, you will be able to disable System Integrity protection and do what you want including fixing /usr/bin/git. What is the problem?

Re: Remote code execution, git, and OS X

#44

Post by atdt » Mon, Apr 18, 2016, 6:56 AM UTC

bronxbomber92 wrote: post #14

aorth wrote: post #6

Earlier quoted context omitted.

Yes, indeed, but Mac OS X users who use Homebrew are a subset of all Mac OS X users. The problem is in the default software. Apple's update model isn't good for this type of software, so the fact that it is possible for a user to install secure versions from Homebrew (or compile their own) doesn't matter.

Xcode is distributed and released over the AppStore and can be rev-ed at any frequency, independently of the OS; Apple's update model not does prevent an expedient update. Perhaps the main cause for delay is the associated QA efforts to make sure that other components in the stack which depend on git don't break in the case that git has broken binary compatibility (i.e. changed its public interface).

If things are tied up in QA, that is a problem in and of itself, because relevance is an important quality for a security bugfix to have. If my system is compromised today, it will do me little good that the bugfix Apple ships next month was tested extensively for compatibility with Xcode.

It is too late for there to be an expedient update from Apple. The vulnerability was disclosed to oss-security over a month ago, on March 15[0]. SUSE had a patch out the next day[1]. By March 24, Debian, Ubuntu, Red Hat, CentOS and Oracle had all issued fixes.[2]

[0]: http://www.openwall.com/lists/oss-security/2016/03/15/5

[1]: http://lists.opensuse.org/opensuse-security-announce/2016-03...

[2]: http://www.securitytracker.com/id/1035290

Re: Remote code execution, git, and OS X

#45

Post by hoppa_liza » Mon, Apr 18, 2016, 6:56 AM UTC

tbrock wrote: post #26

Sensationalism at it's finest. Just use the homebrew version, it will eventually get fixed in OSX proper.

There are several replies in this thread as to why this is not a complete solution.

Re: Remote code execution, git, and OS X

#46

Post by atdt » Mon, Apr 18, 2016, 6:57 AM UTC

brightball wrote: post #15

xyzzy123 wrote: post #8

Earlier quoted context omitted.

Except that git is used specifically by users who are downloading and compiling software.

And at this point the first instruction for any OSX user who downloads and compiles anything is "Install Homebrew"

The Homebrew installation process uses the system git.

Re: Remote code execution, git, and OS X

#47

Post by xyzzy123 » Mon, Apr 18, 2016, 6:59 AM UTC

tadfisher wrote: post #23

xyzzy123 wrote: post #3

$ brew install git $ git --version git version 2.8.1

Now grep your system for `/usr/bin/git`.

$ grep -rc /usr/bin/git /usr/bin/ /usr/local/bin/ /usr/sbin/ /sbin/ | grep -v ':0' | wc -l

Re: Remote code execution, git, and OS X

#48

Post by ubernostrum » Mon, Apr 18, 2016, 7:03 AM UTC

_ZeD_ wrote: post #4

Remember when I said El Capitan? Apple is doing something new which basically keeps you from twiddling certain system-level programs without going to fantastic lengths. Not even root is enough to do it. Can someone explain it to me?

Starting in OS X El Capitan there's a framework to protect sensitive system files which disallows even root from modifying them. The only way to make changes is to (as root) disable that framework, then reboot, make the changes, re-enable and reboot again.

Re: Remote code execution, git, and OS X

#49

Post by yelnatz » Mon, Apr 18, 2016, 7:04 AM UTC

madeofpalk wrote: post #42

yelnatz wrote: post #38

Earlier quoted context omitted.

chmod: /Applications/Xcode.app/Contents/Developer/usr/bin/git: No such file or directory I don't have Xcode installed, do I have to install it back to do this?

If you don't have Xcode installed then you don't have git. IIRC, you might have a /usr/bin/git executable but that's not actually git, all it does is shows a GUI that prompts you to install XCode

Thanks.

Yea, /usr/bin/git is still there:

    $ git --version
    $ git version 2.6.4 (Apple Git-63)

But glad to know it won't do anything.

Re: Remote code execution, git, and OS X

#50

Post by chm » Mon, Apr 18, 2016, 7:04 AM UTC

bndr wrote: post #7

Why the hate for OS X? Fedora 22 and Fedora 23 have only git 2.4.11 and 2.5.5 in their repositories.

Debian stable is still on 2.1.

https://packages.debian.org/jessie/git

      ~ git --version
    git version 2.1.4