Gentoo: GLSA-201509-06: Git: Arbitrary command execution
Summary
A vulnerability in Git causing Git-compatible clients that access case-insensitive or case-normalizing filesystems to overwrite the .git/config when cloning or checking out a repository, leading to execution of arbitrary commands.
Resolution
All Git 1.8.x users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-vcs/git-1.8.5.6"
All Git 1.9.x users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-vcs/git-1.9.5"
All Git 2.0.x users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-vcs/git-2.0.5"
References
[ 1 ] CVE-2014-9390 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-9390
Availability
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/201509-06
Concerns
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
![Dist Gentoo](/images/distros/dist-gentoo.png)
Synopsis
An attacker could execute arbitrary commands via Git repositories in a case-insensitive or case-normalizing filesystem.
Background
Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency.
Affected Packages
------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-vcs/git < 2.0.5 *>= 1.8.5.6 *>= 1.9.5 >= 2.0.5
Impact
===== An attacker can execute arbitrary commands on a client machine that clones a crafted malicious Git tree.
Workaround
There is no known workaround at this time.