full-disclosure - [ MDVSA-2009:176 ] git

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E1MW6kO-0006f8-8p@titan.mandriva.com>
Date: Wed, 29 Jul 2009 12:51:00 +0200
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2009:176 ] git


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2009:176
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : git
 Date    : July 29, 2009
 Affected: Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 A vulnerability has been found and corrected in git:
 
 git-daemon in git 1.4.4.5 through 1.6.3 allows remote attackers to
 cause a denial of service (infinite loop and CPU consumption) via a
 request containing extra unrecognized arguments (CVE-2009-2108).
 
 This update provides fixes for this vulnerability.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2108
 _______________________________________________________________________

 Updated Packages:

 Mandriva Enterprise Server 5:
 12264c9724568a641a2f73ac9ea5893d  mes5/i586/git-1.6.0.6-0.1mdvmes5.i586.rpm
 f4855794596052fd21b102078ecfbd24  mes5/i586/git-arch-1.6.0.6-0.1mdvmes5.i586.rpm
 eff76dc25ebaa2894cf675b3846a005b  mes5/i586/git-core-1.6.0.6-0.1mdvmes5.i586.rpm
 bf1b3d3a0b32203383c976cde6c9a71c  mes5/i586/git-core-oldies-1.6.0.6-0.1mdvmes5.i586.rpm
 6bddb82834ea49bc591b39be6848d1ab  mes5/i586/git-cvs-1.6.0.6-0.1mdvmes5.i586.rpm
 5518e31af017d9cc2cdd7ac24fde5f7e  mes5/i586/git-email-1.6.0.6-0.1mdvmes5.i586.rpm
 6948989d6d6e268e7837511fca78337d  mes5/i586/gitk-1.6.0.6-0.1mdvmes5.i586.rpm
 8a642fb53eaab819c21005cf6ce855e3  mes5/i586/git-svn-1.6.0.6-0.1mdvmes5.i586.rpm
 0d895d128ae30db3c346c0d8717736c2  mes5/i586/gitview-1.6.0.6-0.1mdvmes5.i586.rpm
 ad8683ec4c819b7045946c31e4dcc8d2  mes5/i586/gitweb-1.6.0.6-0.1mdvmes5.i586.rpm
 781f43d77170635a3a3b6c82b1da4c87  mes5/i586/libgit-devel-1.6.0.6-0.1mdvmes5.i586.rpm
 f2da4280e6b0a6b1c0d0d02d415ad92b  mes5/i586/perl-Git-1.6.0.6-0.1mdvmes5.i586.rpm 
 2141d03fd7e15670ec997a7c54e7fd8a  mes5/SRPMS/git-1.6.0.6-0.1mdvmes5.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 4ea19e1b57552a70afe989c5bccd835a  mes5/x86_64/git-1.6.0.6-0.1mdvmes5.x86_64.rpm
 1c1568586c6f667e856d56e68440f0c7  mes5/x86_64/git-arch-1.6.0.6-0.1mdvmes5.x86_64.rpm
 585d86a660d47420ab88f8e3631ebb20  mes5/x86_64/git-core-1.6.0.6-0.1mdvmes5.x86_64.rpm
 d88542185ea8e25eead22f3638e4b1ce  mes5/x86_64/git-core-oldies-1.6.0.6-0.1mdvmes5.x86_64.rpm
 bcb5c3dafc15e51e2012cddebaded84e  mes5/x86_64/git-cvs-1.6.0.6-0.1mdvmes5.x86_64.rpm
 91ecd5ab7b4e96524e375926a7e4b959  mes5/x86_64/git-email-1.6.0.6-0.1mdvmes5.x86_64.rpm
 1a71d4678919ca9d1a844a97d09e4720  mes5/x86_64/gitk-1.6.0.6-0.1mdvmes5.x86_64.rpm
 e85fcebfe53bc0676ea1874d8a33f3be  mes5/x86_64/git-svn-1.6.0.6-0.1mdvmes5.x86_64.rpm
 2e27c62f2854040f44177547bed50e4a  mes5/x86_64/gitview-1.6.0.6-0.1mdvmes5.x86_64.rpm
 e8b87bef440f28fac9c104da7759f248  mes5/x86_64/gitweb-1.6.0.6-0.1mdvmes5.x86_64.rpm
 dc20524019e37fafa8e32ec215ff0b4b  mes5/x86_64/lib64git-devel-1.6.0.6-0.1mdvmes5.x86_64.rpm
 45281984d1a055b1ff33068cb7f0514c  mes5/x86_64/perl-Git-1.6.0.6-0.1mdvmes5.x86_64.rpm 
 2141d03fd7e15670ec997a7c54e7fd8a  mes5/SRPMS/git-1.6.0.6-0.1mdvmes5.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFKb/9gmqjQ0CJFipgRAuc8AJ9A/vGFxj8NXAQeuSv7uiUP1B8i5wCgx3TW
ylo2C5LWr8AqavOYLHGimZk=
=Lu2Y
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/