gitweb/gitweb.perl in gitweb in Git 1.6.x before 1.6.0.6, 1.5.6.x before 1.5.6.6, 1.5.5.x before 1.5.5.6, 1.5.4.x before 1.5.4.7, and other versions after 1.4.3 allows local repository owners to execute arbitrary commands by modifying the diff.external configuration variable and executing a crafted gitweb query.

It was discovered that Git did not properly handle long file paths. If a user were tricked into performing commands on a specially crafted Git repository, an attacker could possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-3546)

It was discovered that the Git web interface (gitweb) did not correctly handle shell metacharacters when processing certain commands. A remote attacker could send specially crafted commands to the Git server and execute arbitrary code with the privileges of the Git web server. This issue only applied to Ubuntu 7.10 and 8.04 LTS.
(CVE-2008-5516, CVE-2008-5517)

It was discovered that the Git web interface (gitweb) did not properly restrict the diff.external configuration parameter. A local attacker could exploit this issue and execute arbitrary code with the privileges of the Git web server. This issue only applied to Ubuntu 8.04 LTS and 8.10. (CVE-2008-5916).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200903-15 (git: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in gitweb that is part of     the git package:
    Shell metacharacters related to git_search are not properly sanitized     (CVE-2008-5516).
    Shell metacharacters related to git_snapshot and git_object are not     properly sanitized (CVE-2008-5517).
    The diff.external configuration variable as set in a repository can be     executed by gitweb (CVE-2008-5916).
  Impact :

    A remote unauthenticated attacker can execute arbitrary commands via     shell metacharacters in a query, remote attackers with write access to     a git repository configuration can execute arbitrary commands with the     privileges of the user running gitweb by modifying the diff.external     configuration variable in the repository and sending a crafted query to     gitweb.
  Workaround :

    There is no known workaround at this time.

It was discovered that gitweb, the web interface for the Git version control system, contained several vulnerabilities :

Remote attackers could use crafted requests to execute shell commands on the web server, using the snapshot generation and pickaxe search functionality (CVE-2008-5916 ).

Local users with write access to the configuration of a Git repository served by gitweb could cause gitweb to execute arbitrary shell commands with the permission of the web server (CVE-2008-5516, CVE-2008-5517 ).

This update fixes a local privilege escalation bug in gitweb. For details:
http://article.gmane.org/gmane.comp.version-control.git/103624

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes a local privilege escalation bug in gitweb. For details:
http://article.gmane.org/gmane.comp.version-control.git/103624 Additionally, gitk has been added as a requirement of git-gui (bug 476308) and perl(Net::SMTP::SSL) has been added as a requirement of git-send-email (bug 443615).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
36720	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : git-core vulnerabilities (USN-723-1)	Nessus	Ubuntu Local Security Checks	high
35813	GLSA-200903-15 : git: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
35425	Debian DSA-1708-1 : git-core - shell command injection	Nessus	Debian Local Security Checks	high
35256	Fedora 8 : git-1.5.4.3-3.fc8 (2008-11653)	Nessus	Fedora Local Security Checks	medium
35255	Fedora 9 : git-1.5.6.6-1.fc9 (2008-11650)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2008-5916

high

Tenable Plugins

high

high

high

medium

medium