[ GLSA 201509-06 ] Git

[GLSA]

Gentoo Linux Security Advisory

Title: Git: Arbitrary command execution (GLSA 201509-06)
Severity: normal
Exploitable: remote
Date: September 24, 2015
Bug(s): #532984
ID: 201509-06

Synopsis

An attacker could execute arbitrary commands via Git repositories
in a case-insensitive or case-normalizing filesystem.


Background

Git is a free and open source distributed version control system
designed to handle everything from small to very large projects with
speed and efficiency.


Affected Packages

Package: dev-vcs/git
Vulnerable: < 2.0.5
Unaffected: >= 1.8.5.6 < 1.8.5.7
Unaffected: >= 1.9.5 < 1.9.6
Unaffected: >= 2.0.5
Architectures: All supported architectures


Description

A vulnerability in Git causing Git-compatible clients that access
case-insensitive or case-normalizing filesystems to overwrite the
.git/config when cloning or checking out a repository, leading to
execution of arbitrary commands.


Impact

An attacker can execute arbitrary commands on a client machine that
clones a crafted malicious Git tree.


Workaround

There is no known workaround at this time.

Resolution

All Git 1.8.x users should upgrade to the latest version: