Ubuntu Security Notice USN-2470-1
13th January, 2015
git vulnerability
A security issue affects these releases of Ubuntu and its
derivatives:
- Ubuntu 14.10
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary
Git could be made to run programs as your login if it received specially
crafted changes from a remote repository.
Software description
- git
– fast, scalable, distributed revision control system
Details
Matt Mackall and Augie Fackler discovered that Git incorrectly handled certain
filesystem paths. A remote attacker could possibly use this issue to execute
arbitrary code if the Git tree is stored in an HFS+ or NTFS filesystem. The
remote attacker would need write access to a Git repository that the victim
pulls from.
Update instructions
The problem can be corrected by updating your system to the following
package version:
- Ubuntu 14.10:
-
git
1:2.1.0-1ubuntu0.1
- Ubuntu 14.04 LTS:
-
git
1:1.9.1-1ubuntu0.1
- Ubuntu 12.04 LTS:
-
git
1:1.7.9.5-1ubuntu0.1
To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.
After a standard system update you need to set the core.protectHFS and/or
core.protectNTFS Git configuration variables to “true” if you store Git trees
in HFS+ and/or NTFS filesystems. If you host Git trees, setting the
core.protectHFS, core.protectNTFS, and receive.fsckObjects Git configuration
variables to “true” will cause your Git server to reject objects containing
malicious paths intended to overwrite the Git metadata.