1. Ubuntu Security Notices
  2. USN-2470-1

USN-2470-1: Git vulnerability

Publication date

14 January 2015

Overview

Git could be made to run programs as your login if it received specially crafted changes from a remote repository.

Releases

Packages

  • git - fast, scalable, distributed revision control system

Details

Matt Mackall and Augie Fackler discovered that Git incorrectly handled certain
filesystem paths. A remote attacker could possibly use this issue to execute
arbitrary code if the Git tree is stored in an HFS+ or NTFS filesystem. The
remote attacker would need write access to a Git repository that the victim
pulls from.

Matt Mackall and Augie Fackler discovered that Git incorrectly handled certain
filesystem paths. A remote attacker could possibly use this issue to execute
arbitrary code if the Git tree is stored in an HFS+ or NTFS filesystem. The
remote attacker would need write access to a Git repository that the victim
pulls from.

Update instructions

After a standard system update you need to set the core.protectHFS and/or core.protectNTFS Git configuration variables to “true” if you store Git trees in HFS+ and/or NTFS filesystems. If you host Git trees, setting the core.protectHFS, core.protectNTFS, and receive.fsckObjects Git configuration variables to “true” will cause your Git server to reject objects containing malicious paths intended to overwrite the Git metadata.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
14.10 utopic git –  1:2.1.0-1ubuntu0.1
14.04 trusty git –  1:1.9.1-1ubuntu0.1
12.04 precise git –  1:1.7.9.5-1ubuntu0.1

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›