b311000a22
16 changes to exploits/shellcodes net-snmp 5.7.3 - Unauthenticated Denial of Service (PoC) net-snmp 5.7.3 - Authenticated Denial of Service (PoC) Linux - Kernel Pointer Leak via BPF Android - sdcardfs Changes current->fs Without Proper Locking 360 3.5.0.1033 - Sandbox Escape Git Submodule - Arbitrary Code Execution Linux Kernel < 4.11.8 - 'mq_notify: double sock_put()' Local Privilege Escalation Zahir Enterprise Plus 6 - Stack Buffer Overflow (Metasploit) Microsoft Windows - Net-NTLMv2 Reflection DCOM/RPC (Metasploit) Cisco Prime Infrastructure - Unauthenticated Remote Code Execution Unitrends UEB - HTTP API Remote Code Execution (Metasploit) Navigate CMS - Unauthenticated Remote Code Execution (Metasploit) FLIR Thermal Traffic Cameras 1.01-0bb5b27 - Information Disclosure Imperva SecureSphere 13 - Remote Command Execution Linux/x86 - execve(/bin/sh) + MMX/ROT13/XOR Shellcode (Encoder/Decoder) (104 bytes) Linux/MIPS (Big Endian) - execve(/bin/sh) + Reverse TCP 192.168.2.157/31337 Shellcode (181 bytes)
26 lines
No EOL
1.4 KiB
Text
26 lines
No EOL
1.4 KiB
Text
These releases fix a security flaw (CVE-2018-17456), which allowed an
|
|
attacker to execute arbitrary code by crafting a malicious .gitmodules
|
|
file in a project cloned with --recurse-submodules.
|
|
|
|
When running "git clone --recurse-submodules", Git parses the supplied
|
|
.gitmodules file for a URL field and blindly passes it as an argument
|
|
to a "git clone" subprocess. If the URL field is set to a string that
|
|
begins with a dash, this "git clone" subprocess interprets the URL as
|
|
an option. This can lead to executing an arbitrary script shipped in
|
|
the superproject as the user who ran "git clone".
|
|
|
|
In addition to fixing the security issue for the user running "clone",
|
|
the 2.17.2, 2.18.1 and 2.19.1 releases have an "fsck" check which can
|
|
be used to detect such malicious repository content when fetching or
|
|
accepting a push. See "transfer.fsckObjects" in git-config(1).
|
|
|
|
Credit for finding and fixing this vulnerability goes to joernchen
|
|
and Jeff King, respectively.
|
|
|
|
P.S. Folks at Microsoft tried to follow the known exploit recipe on
|
|
Git for Windows (but not Cygwin or other Git implementations on
|
|
Windows) and found that the recipe (or its variants they can think
|
|
of) would not make their system vulnerable. This is due to the fact
|
|
that the type of submodule path require by the known exploit recipe
|
|
cannot be created on Windows. Nonetheless, it is possible we have
|
|
missed some exploitation path and users are encouraged to upgrade. |