Server and Client RCE in Git version 2.7.1 and below

#1

Post by breadtk » Tue, Mar 15, 2016, 7:55 PM UTC

Server and Client RCE in Git version 2.7.1 and below
seclists.org

Re: Server and Client RCE in Git version 2.7.1 and below

#2

Post by 0x0 » Tue, Mar 15, 2016, 8:04 PM UTC

Sounds like this could be a big deal for bitbucket.org and gitlab.com? Esp. considering private repositories there.

Re: Server and Client RCE in Git version 2.7.1 and below

#3

Post by Mojah » Tue, Mar 15, 2016, 9:29 PM UTC

Public mirror here if the official ones go down: https://marc.ttias.be/oss-security/2016-03/msg00180.php

Re: Server and Client RCE in Git version 2.7.1 and below

#4

Post by swiley » Tue, Mar 15, 2016, 9:30 PM UTC

Git kind of implies that you're going to execute something from the remote end anyway so it's not something like hartbleed....

Re: Server and Client RCE in Git version 2.7.1 and below

#5

Post by teamhappy » Tue, Mar 15, 2016, 9:45 PM UTC

swiley wrote: post #4

Git kind of implies that you're going to execute something from the remote end anyway so it's not something like hartbleed....

Remote code execution is worse than Heartbleed.

Re: Server and Client RCE in Git version 2.7.1 and below

#6

Post by Mojah » Tue, Mar 15, 2016, 10:21 PM UTC

A couple of thoughts on the potential impact: https://ma.ttias.be/remote-code-execution-git-versions-clien...

Server-side: github & bitbucket will get patched quickly, if they're even still vulnerable. Self-hosted installations like Gitlab will be more difficult, as it requires sysadmins to patch themselves. History has thought us this takes too long.

Client-side: possibly the biggest impact, as nearly every Linux distribution ships vulnerable versions. Any kind of local system user activity could trigger the RCE. Technically, that includes any PHP, Ruby or Python site that allows shell commands to be executed - which, by default, they nearly all do.

It has all the potential to be huge.

Re: Server and Client RCE in Git version 2.7.1 and below

#7

Post by swiley » Tue, Mar 15, 2016, 10:34 PM UTC

teamhappy wrote: post #5

swiley wrote: post #4

Git kind of implies that you're going to execute something from the remote end anyway so it's not something like hartbleed....

Remote code execution is worse than Heartbleed.

Oops, my bad. I didn't realize this was a server side issue, that is pretty bad.

Re: Server and Client RCE in Git version 2.7.1 and below

#8

Post by krallin » Tue, Mar 15, 2016, 10:35 PM UTC

Note: if you're using Ubuntu, there is a semi-official PPA that has a non-vulnerable version (2.7.3): https://launchpad.net/~git-core/+archive/ubuntu/ppa

Re: Server and Client RCE in Git version 2.7.1 and below

#9

Post by wyldfire » Tue, Mar 15, 2016, 11:31 PM UTC

krallin wrote: post #8

Note: if you're using Ubuntu, there is a semi-official PPA that has a non-vulnerable version (2.7.3): https://launchpad.net/~git-core/+archive/ubuntu/ppa

But a fix should come via the normal update channel soon? I'm on wily, should I expect to add this PPA or risk vulnerability?

Re: Server and Client RCE in Git version 2.7.1 and below

#10

Post by voltagex_ » Tue, Mar 15, 2016, 11:41 PM UTC

wyldfire wrote: post #9

krallin wrote: post #8

Note: if you're using Ubuntu, there is a semi-official PPA that has a non-vulnerable version (2.7.3): https://launchpad.net/~git-core/+archive/ubuntu/ppa

But a fix should come via the normal update channel soon? I'm on wily, should I expect to add this PPA or risk vulnerability?

Ubuntu should announce the fix at https://www.ubuntu.com/usn/ but I can't load the page right now.

(removed DSA link as per advice below)