Cross-site scripting (XSS) vulnerability in Gitweb 1.7.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) f and (2) fp parameters.

This update fixes two vulnerabilities :

XSS vulnerability in gitweb; a remote attacker could craft an URL such that arbitrary content would be inserted to the generated web page.

Stack overflow vulnerability that can lead to arbitrary code execution if user runs any git command on a specially crafted git working copy.

Security Issue references :

- [CVE-2010-3906](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-3906) 

- [CVE-2010-2542](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-2542)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2010-1003 advisory.

    [1.7.1-2.1]
    - fix CVE-2010-3906

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A cross-site scripting (XSS) flaw was found in gitweb, a simple web interface for Git repositories. A remote attacker could perform an XSS attack against victims by tricking them into visiting a specially crafted gitweb URL. (CVE-2010-3906)

Update to 1.7.3.4 release which fixes various issues, notably :

  - cross-site scripting (XSS) flaw was found in the web     interface of Git distributed revision control system. A     remote attacker could use this flaw to execute arbitrary     HTML or scripting code by providing a certain URL with     specially crafted values of f and fp variables.
    (CVE-2010-3906)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of gitweb, a web-enabled interface to the open source distributed version control system Git, hosted on the remote web server fails to sanitize user-supplied input to the 'f' and 'fp' parameters before using it to generate dynamic HTML.

An attacker may be able to leverage this issue to inject arbitrary HTML or script code into a user's browser to be executed within the security context of the affected site.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2010:1003 advisory.

  - Git (gitweb): XSS due to missing escaping of HTML element attributes (CVE-2010-3906)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A vulnerability was discovered and corrected in git (gitweb) :

A cross-site scripting (XSS) vulnerability in Gitweb 1.7.3.3 and previous versions allows remote attackers to inject arbitrary web script or HTML code via f and fp variables (CVE-2010-3906).

The updated packages have been patched to correct this issue.

ID	Name	Product	Family	Severity
75516	openSUSE Security Update : git (openSUSE-SU-2011:0115-1)	Nessus	SuSE Local Security Checks	high
68171	Oracle Linux 6 : git (ELSA-2010-1003)	Nessus	Oracle Linux Local Security Checks	medium
60927	Scientific Linux Security Update : git on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
53727	openSUSE Security Update : git (openSUSE-SU-2011:0115-1)	Nessus	SuSE Local Security Checks	high
51406	Fedora 13 : git-1.7.3.4-1.fc13 (2010-18973)	Nessus	Fedora Local Security Checks	medium
51373	Fedora 14 : git-1.7.3.4-1.fc14 (2010-18981)	Nessus	Fedora Local Security Checks	medium
51370	Git gitweb Multiple Parameter XSS	Nessus	CGI abuses : XSS	medium
51358	RHEL 6 : git (RHSA-2010:1003)	Nessus	Red Hat Local Security Checks	medium
51336	Mandriva Linux Security Advisory : git (MDVSA-2010:256)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2010-3906

medium

Tenable Plugins

high

medium

medium

high

medium

medium

medium

medium

medium