Summary
The remote host is missing an update to git-core
announced via advisory USN-723-1.
Solution
The problem can be corrected by upgrading your system to the following package versions:
Ubuntu 6.06 LTS:
git-core 1.1.3-1ubuntu1.1
Ubuntu 7.10:
git-core 1:1.5.2.5-2ubuntu0.1 gitweb 1:1.5.2.5-2ubuntu0.1
Ubuntu 8.04 LTS:
git-core 1:1.5.4.3-1ubuntu2.1 gitweb 1:1.5.4.3-1ubuntu2.1
Ubuntu 8.10:
git-core 1:1.5.6.3-1.1ubuntu2.1 gitweb 1:1.5.6.3-1.1ubuntu2.1
In general, a standard system upgrade is sufficient to effect the necessary changes.
https://secure1.securityspace.com/smysecure/catid.html?in=USN-723-1
Insight
It was discovered that Git did not properly handle long file paths. If a user were tricked into performing commands on a specially crafted Git repository, an attacker could possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-3546)
It was discovered that the Git web interface (gitweb) did not correctly handle shell metacharacters when processing certain commands. A remote attacker could send specially crafted commands to the Git server and execute arbitrary code with the privileges of the Git web server. This issue only applied to Ubuntu 7.10 and 8.04 LTS. (CVE-2008-5516, CVE-2008-5517)
It was discovered that the Git web interface (gitweb) did not properly restrict the diff.external configuration parameter. A local attacker could exploit this issue and execute arbitrary code with the privileges of the Git web server.
This issue only applied to Ubuntu 8.04 LTS and 8.10. (CVE-2008-5916)
Severity
Classification
-
CVSS Base Score: 10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
Related Vulnerabilities
- Ubuntu Update for dhcp vulnerability USN-531-1
- Ubuntu Update for bsd-mailx USN-2455-1
- Ubuntu Update for apturl, Epiphany, gecko-sharp, gnome-python-extras, liferea, rhythmbox, totem, ubufox, yelp update USN-930-2
- Ubuntu Update for cupsys vulnerabilities USN-563-1
- Ubuntu Update for enscript vulnerability USN-660-1