Stack-based buffer overflow in the (1) diff_addremove and (2) diff_change functions in GIT before 1.5.6.4 might allow local users to execute arbitrary code via a PATH whose length is larger than the system's PATH_MAX when running GIT utilities such as git-diff or git-grep.

This patch fixes several buffer overflows in some git tools, when repositories contain very long pathnames. (CVE-2008-3546)

It was discovered that Git did not properly handle long file paths. If a user were tricked into performing commands on a specially crafted Git repository, an attacker could possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-3546)

It was discovered that the Git web interface (gitweb) did not correctly handle shell metacharacters when processing certain commands. A remote attacker could send specially crafted commands to the Git server and execute arbitrary code with the privileges of the Git web server. This issue only applied to Ubuntu 7.10 and 8.04 LTS.
(CVE-2008-5516, CVE-2008-5517)

It was discovered that the Git web interface (gitweb) did not properly restrict the diff.external configuration parameter. A local attacker could exploit this issue and execute arbitrary code with the privileges of the Git web server. This issue only applied to Ubuntu 8.04 LTS and 8.10. (CVE-2008-5916).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New git packages are available for Slackware 12.0, 12.1, 12.2, and
-current to fix security issues.

----------------------------------------------------------------------
---------- ChangeLog :

  - Wed Oct 22 2008 Josh Boyer <jwboyer at gmail.com>     1.5.6.5-1

    - git-1.5.6.5 (bug 458156)

    - Mon May 26 2008 James Bowes <jbowes at redhat.com>       1.5.5.2-1

    - git-1.5.5.2

    - Fri May 23 2008 Dennis Gilmore <dennis at ausil.us>       1.5.5.1-1.1

    - minor rebuild for sparc

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200809-16 (Git: User-assisted execution of arbitrary code)

    Multiple boundary errors in the functions diff_addremove() and     diff_change() when processing overly long repository path names were     reported.
  Impact :

    A remote attacker could entice a user to run commands like 'git-diff'     or 'git-grep' on a specially crafted repository, possibly resulting in     the remote execution of arbitrary code with the privileges of the user     running the application.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilities have been identified in git-core, the core of the git distributed revision control system. Improper path length limitations in git's diff and grep functions, in combination with maliciously crafted repositories or changes, could enable a stack-based buffer overflow and potentially the execution of arbitrary code.

The Common Vulnerabilities and Exposures project identifies this vulnerability as CVE-2008-3546.

ID	Name	Product	Family	Severity
39969	openSUSE Security Update : git (git-183)	Nessus	SuSE Local Security Checks	high
36720	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : git-core vulnerabilities (USN-723-1)	Nessus	Ubuntu Local Security Checks	high
35728	Slackware 12.0 / 12.1 / 12.2 / current : git (SSA:2009-051-02)	Nessus	Slackware Local Security Checks	high
34483	Fedora 9 : git-1.5.6.5-1.fc9 (2008-9080)	Nessus	Fedora Local Security Checks	high
34297	GLSA-200809-16 : Git: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
34212	Debian DSA-1637-1 : git-core - buffer overflow	Nessus	Debian Local Security Checks	high
34153	openSUSE 10 Security Update : git (git-5585)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2008-3546

high

Tenable Plugins

high

high

high

high

high

high

high