full-disclosure - Re: [FD] server and client side remote code execution through a buffer overflow in all git versions before 2.7.1 (unpublished ᴄᴠᴇ-2016-2324 and ᴄᴠᴇ‑2016‑2315)

Open Source and information security mailing list archives

Date: Fri, 18 Mar 2016 09:59:21 +0100
From: Laël Cellier <lael.cellier@...oste.net>
To: fulldisclosure@...lists.org, bugtraq@...urityfocus.com,
 dailydave@...ts.immunityinc.com
Subject: Re: [FD]
 server and client side remote code execution through a buffer overflow in all git versions before 2.7.1 (unpublished ᴄᴠᴇ-2016-2324 and ᴄᴠᴇ‑2016‑2315)

Oh………………………… Big mistake. I might advertised too soon.

I saw changes were pushed in master, so I thought the next version 
(which was 2.7.1) would be the one which will include the fix.
But as pointed out on 
https://security-tracker.debian.org/tracker/CVE-2016-2324 no versions 
including the fixes were released yet, and even 2.7.3 still include 
path_name(). I didn’t checked the code (Sorrrry).

So the only way to fix it is to draw your compilers and compile the 
current master branch at https://git.kernel.org/cgit/git/git.git/.
Or do like github did by using the patches at 
http://thread.gmane.org/gmane.comp.version-control.git/286253 and 
http://thread.gmane.org/gmane.comp.version-control.git/286008

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives