Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.

The remote host is affected by the vulnerability described in GLSA-201612-19 (Mercurial: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mercurial. Please       review the CVE identifier and bug reports referenced for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-201509-06 (Git: Arbitrary command execution)

    A vulnerability in Git causing Git-compatible clients that access       case-insensitive or case-normalizing filesystems to overwrite the       .git/config when cloning or checking out a repository, leading to       execution of arbitrary commands.
  Impact :

    An attacker can execute arbitrary commands on a client machine that       clones a crafted malicious Git tree.
  Workaround :

    There is no known workaround at this time.

The git web frontend cgit was updated to 0.11.2 to fix security issues and bugs.

The following vulnerabilities were fixed :

  - CVE-2014-9390: arbitrary command execution vulnerability     on case-insensitive file systems in git. Malicious     commits could affect client users on all platforms using     case-insensitive file systems when using vulnerable git     versions.

In addition cgit was updated to 0.11.2 with minor improvements and bug fixes.

The embedded git version was updated to 2.4.3.

CVE-2014-9462

Jesse Hertz of Matasano Security discovered that Mercurial, a distributed version control system, is prone to a command injection vulnerability via a crafted repository name in a clone command.

CVE-2014-9390

is a security vulnerability that affects mercurial repositories in a case-insensitive filesystem (eg. VFAT or HFS+). It allows for remote code execution of a specially crafted repository. This is less severe for the average Debian installation as they are usually set up with case-sensitive filesystems.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following security issue :

  - CVE-2014-9390: arbitrary command execution vulnerability     on case- insensitive file system (bnc#910756)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

libgit2 was updated to fix an arbitrary command execution vulnerability on case-insentitive file systems.

The following vulnerability was fixed :

  - When using programs using libgit2 on case-insensitive     filesystems, .git/config could be overwritten, which     allowed execution of arbitrary commands (boo#925040,     CVE-2014-9390).

The configuration is uncommon as all default file systems on openSUSE are case sensitive.

Additionally, on openSUSE 13.2 libgit2 was updated to version 0.21.5 to backport further critical fixes.

Updated git packages fix security vulnerability :

It was reported that git, when used as a client on a case-insensitive filesystem, could allow the overwrite of the .git/config file when the client performed a git pull. Because git permitted committing .Git/config (or any case variation), on the pull this would replace the user's .git/config. If this malicious config file contained defined external commands (such as for invoking and editor or an external diff utility) it could allow for the execution of arbitrary code with the privileges of the user running the git client (CVE-2014-9390).

The Apple Xcode installed on the remote Mac OS X host is prior to version 6.2. It is, therefore, affected by the following vulnerabilities :

  - Numerous errors exist related to the bundled version of Apache Subversion. (CVE-2014-3522, CVE-2014-3528,     CVE-2014-3580, CVE-2014-8108)

  - An error exists related to the bundled version of Git that allows arbitrary files to be added to the .git     folder. (CVE-2014-9390)

This update fixes the following security issue :

  - CVE-2014-9390: arbitrary command execution vulnerability     on case-insensitive file system ( bnc#910756)

Matt Mackall and Augie Fackler discovered that Git incorrectly handled certain filesystem paths. A remote attacker could possibly use this issue to execute arbitrary code if the Git tree is stored in an HFS+ or NTFS filesystem. The remote attacker would need write access to a Git repository that the victim pulls from.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Visual Studio installed on the remote host is affected by a command execution vulnerability when processing specially crafted git trees in a case-insensitive or case-normalizing file system. A remote attacker, using a specially crafted git tree, can overwrite a user's '.git/config' file when the user clones or checks out a repository, allowing arbitrary command execution.

The version of Git for Windows (also known as msysGit) installed on the remote host is prior to 1.9.5. It is, therefore, affected by a command execution vulnerability when processing specially crafted git trees in a case-insensitive or case-normalizing file system. A remote attacker, using a specially crafted git tree, can overwrite a user's '.git/config' file when the user clones or checks out a repository, allowing arbitrary command execution.

The remote Mac OS X host has a version of GitHub prior to 194 installed. It is, therefore, affected by a remote command execution vulnerability when processing git trees in a case-insensitive or case-normalizing file system. A remote attacker, using a specially crafted git tree, can overwrite a user's '.git/config' file when the user clones or checks out a repository, allowing arbitrary command execution.

The version of GitHub for Windows installed on the remote host is prior to 2.6.5. It is, therefore, affected by a command execution vulnerability when processing specially crafted git trees in a case-insensitive or case-normalizing file system. A remote attacker, using a specially crafted git tree, can overwrite a user's '.git/config' file when the user clones or checks out a repository, allowing arbitrary command execution.

The Git Project reports :

When using a case-insensitive filesystem an attacker can craft a malicious Git tree that will cause Git to overwrite its own .git/config file when cloning or checking out a repository, leading to arbitrary command execution in the client machine. If you are a hosting service whose users may fetch from your service to Windows or Mac OS X machines, you are strongly encouraged to update to protect such users who use existing versions of Git.

ID	Name	Product	Family	Severity
95605	GLSA-201612-19 : Mercurial: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
86137	GLSA-201509-06 : Git: Arbitrary command execution	Nessus	Gentoo Local Security Checks	critical
84335	openSUSE Security Update : cgit (openSUSE-2015-436)	Nessus	SuSE Local Security Checks	critical
83995	Debian DLA-237-1 : mercurial security update	Nessus	Debian Local Security Checks	critical
83671	SUSE SLES12 Security Update : git (SUSE-SU-2015:0100-1)	Nessus	SuSE Local Security Checks	critical
82634	openSUSE Security Update : libgit2 (openSUSE-2015-288)	Nessus	SuSE Local Security Checks	critical
82422	Mandriva Linux Security Advisory : git (MDVSA-2015:169)	Nessus	Mandriva Local Security Checks	high
81758	Apple Xcode < 6.2 (Mac OS X)	Nessus	MacOS X Local Security Checks	medium
81064	openSUSE Security Update : git (openSUSE-SU-2015:0159-1)	Nessus	SuSE Local Security Checks	critical
80517	Ubuntu 14.04 LTS : Git vulnerability (USN-2470-1)	Nessus	Ubuntu Local Security Checks	critical
80333	Microsoft Visual Studio .git\config Command Execution	Nessus	Windows	medium
80306	Git for Windows .git/config Command Execution	Nessus	Windows	medium
80220	GitHub < 1.9.4 .git/config Command Execution (Mac OS X)	Nessus	MacOS X Local Security Checks	medium
80202	GitHub for Windows < 2.6.5 .git/config Command Execution	Nessus	Windows	medium
80148	FreeBSD : git -- Arbitrary command execution on case-insensitive filesystems (1d567278-87a5-11e4-879c-000c292ee6b8)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2014-9390

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

high

medium

critical

critical

medium

medium

medium

medium

critical