full-disclosure - [PLSA 2008-19] Git: Multiple Buffer Overflows

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <489A417F.5060200@pardus.org.tr>
Date: Thu, 07 Aug 2008 03:27:43 +0300
From: Pınar Yanardağ <pinar@...dus.org.tr>
To: pardus-security@...dus.org.tr
Cc: full-disclosure@...ts.grok.org.uk
Subject: [PLSA 2008-19] Git: Multiple Buffer Overflows

------------------------------------------------------------------------
Pardus Linux Security Advisory 2008-19            security@...dus.org.tr
------------------------------------------------------------------------
       Date: 2008-08-07
   Severity: 2
       Type: Remote
------------------------------------------------------------------------

Summary
=======

Some vulnerabilities have been reported in GIT, which can potentially be
exploited by malicious people to compromise a user's system.

Description
===========

The vulnerabilities are  caused  due  to  boundary  errors  in  various
functions when processing overly long repository pathnames. These can be
exploited to cause stack-based buffer overflows by tricking a user into
running e.g. "git-diff" or "git-grep" against a  repository  containing
pathnames that are larger than  the  "PATH_MAX"  value  on  the  user's
system.

Successful exploitation may allow execution of arbitrary code.

Affected packages:

   Pardus 2008:
     git, all before 1.5.6.4-66-3
     git-emacs, all before 1.5.6.4-66-3
     gitweb, all before 1.5.6.4-66-3

   Pardus 2007:
     git, all before 1.5.6.4-66-51
     git-emacs, all before 1.5.6.4-66-25
     gitweb, all before 1.5.6.4-66-27

Resolution
==========

There are update(s) for git, git-emacs, gitweb. You can update them via
Package Manager or with a single command from console:

   Pardus 2008:
     pisi up git git-emacs gitweb

   Pardus 2007:
     pisi up git git-emacs gitweb

References
==========

   * http://www.kernel.org/pub/software/scm/git/docs/RelNotes-1.5.6.4.txt
   * http://kerneltrap.org/mailarchive/git/2008/7/16/2529284
   * http://secunia.com/advisories/31347/

------------------------------------------------------------------------

-- 
Pınar Yanardağ
http://pinguar.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/