bugtraq - Re: server and client side remote code execution through a buffer overflow in all git versions before 2.7.1 (unpublished ᴄᴠᴇ-2016-2324 and ᴄᴠᴇ‑2016‑2315)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <e186e8b2-9735-ce21-d807-57608611a92e@laposte.net>
Date: Fri, 18 Mar 2016 09:59:21 +0100
From: Laël Cellier <lael.cellier@...oste.net>
To: fulldisclosure@...lists.org, bugtraq@...urityfocus.com,
  dailydave@...ts.immunityinc.com
Subject: Re: server and client side remote code execution through a buffer overflow in all git versions before 2.7.1 (unpublished ᴄᴠᴇ-2016-2324 and ᴄᴠᴇ‑2016‑2315)

Oh………………………… Big mistake. I might advertised too soon.

I saw changes were pushed in master, so I thought the next version 
(which was 2.7.1) would be the one which will include the fix.
But as pointed out on 
https://security-tracker.debian.org/tracker/CVE-2016-2324 no versions 
including the fixes were released yet, and even 2.7.3 still include 
path_name(). I didn’t checked the code (Sorrrry).

So the only way to fix it is to draw your compilers and compile the 
current master branch at https://git.kernel.org/cgit/git/git.git/.
Or do like github did by using the patches at 
http://thread.gmane.org/gmane.comp.version-control.git/286253 and 
http://thread.gmane.org/gmane.comp.version-control.git/286008