CVE-2014-9390
published 2020-02-12CVE-2014-9390: Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows…
PriorityP180critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
63.18%
99.1th percentile
Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
Affected
39 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | xcode | <= 6.1.1 | — |
| apple | xcode | — | — |
| apple | xcode | — | — |
| debian | dulwich | < dulwich 0.10.1-1 (bookworm) | dulwich 0.10.1-1 (bookworm) |
| debian | git | < dulwich 0.10.1-1 (bookworm) | dulwich 0.10.1-1 (bookworm) |
| debian | jgit | < dulwich 0.10.1-1 (bookworm) | dulwich 0.10.1-1 (bookworm) |
| debian | libgit2 | < dulwich 0.10.1-1 (bookworm) | dulwich 0.10.1-1 (bookworm) |
| debian | mercurial | < dulwich 0.10.1-1 (bookworm) | dulwich 0.10.1-1 (bookworm) |
| dulwich_project | dulwich | >= 0 < 0.10.1-1 | 0.10.1-1 |
| dulwich_project | dulwich | >= 0 < 0.10.1-1 | 0.10.1-1 |
| dulwich_project | dulwich | >= 0 < 0.10.1-1 | 0.10.1-1 |
| dulwich_project | dulwich | >= 0 < 0.10.1-1 | 0.10.1-1 |
| eclipse | egit | < 08-12-2014 | 08-12-2014 |
| eclipse | jgit | < 3.4.2 | 3.4.2 |
| eclipse | jgit | >= 0 < 3.7.0-1 | 3.7.0-1 |
| eclipse | jgit | >= 0 < 3.7.0-1 | 3.7.0-1 |
| eclipse | jgit | >= 0 < 3.7.0-1 | 3.7.0-1 |
| eclipse | jgit | >= 0 < 3.7.0-1 | 3.7.0-1 |
| eclipse | jgit | >= 3.5.0 < 3.5.3 | 3.5.3 |
| git-scm | git | < 1.8.5.6 | 1.8.5.6 |
| git-scm | git | >= 1.9.0 < 1.9.5 | 1.9.5 |
| git-scm | git | >= 2.0.0 < 2.0.5 | 2.0.5 |
| git-scm | git | >= 2.1.0 < 2.1.4 | 2.1.4 |
| git-scm | git | >= 2.2.0 < 2.2.1 | 2.2.1 |
| git | git | >= 0 < 1:2.1.4-1 | 1:2.1.4-1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect Git clients fetching from a malicious server by monitoring HTTP User-Agent strings matching '^git/' combined with requests to paths under a suspicious Git URI; the exploit serves crafted objects under /objects/ and /info/refs. ↗
- →On Git servers, enable receive.fsckObjects, core.protectHFS, and core.protectNTFS to reject inbound objects containing malicious paths (.git case variants, Unicode ignorable codepoints, 8.3 short names like git~1). ↗
- →Detect Mercurial exploitation attempts by monitoring for HTTP User-Agent strings matching '^mercurial/' fetching a repository that advertises a 'getbundle' capability, combined with a hook file named 'update' being written to the .hg/hooks directory. ↗
- →The Mercurial exploit server responds to '?cmd=capabilities' with 'heads getbundle=HG10UN'; network signatures matching this exact capability string from an unexpected server may indicate a malicious Mercurial instance. ↗
- ·The vulnerability is only exploitable when the local Git repository resides on a case-insensitive filesystem (HFS+, NTFS). Systems using case-sensitive filesystems (ext2/3/4, XFS) are not affected. ↗
- ·After patching, operators must explicitly set core.protectHFS and/or core.protectNTFS to 'true' in Git configuration to activate the new protections; patching alone does not enable them. ↗
- ·The Metasploit module only fully implements the case-insensitive filesystem vector (Git on Windows/macOS); the Unicode ignorable codepoint and Windows 8.3 short-name vectors are not yet operationally complete in the module. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
JGit Improper Input Validation vulnerability
ghsa·2022-05-17
CVE-2014-9390 [CRITICAL] CWE-20 JGit Improper Input Validation vulnerability
JGit Improper Input Validation vulnerability
Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine; libgit2; Egit; and JGit allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
OSV
JGit Improper Input Validation vulnerability
osv·2022-05-17
CVE-2014-9390 [CRITICAL] JGit Improper Input Validation vulnerability
JGit Improper Input Validation vulnerability
Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine; libgit2; Egit; and JGit allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
OSV
CVE-2014-9390: Git before 1
osv·2020-02-12·CVSS 9.8
CVE-2014-9390 [CRITICAL] CVE-2014-9390: Git before 1
Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
Ubuntu
Git vulnerability
vendor_ubuntu·2015-01-14
CVE-2014-9390 Git vulnerability
Title: Git vulnerability
Summary: Git could be made to run programs as your login if it received specially
crafted changes from a remote repository.
Matt Mackall and Augie Fackler discovered that Git incorrectly handled certain
filesystem paths. A remote attacker could possibly use this issue to execute
arbitrary code if the Git tree is stored in an HFS+ or NTFS filesystem. The
remote attacker would need write access to a Git repository that the victim
pulls from.
Instructions: After a standard system update you need to set the core.protectHFS and/or
core.protectNTFS Git configuration variables to "true" if you store Git trees
in HFS+ and/or NTFS filesystems. If you host Git trees, setting the
core.protectHFS, core.protectNTFS, and receive.fsckObjects Git configuration
variables to "tru
Red Hat
git: arbitrary command execution vulnerability on case-insensitive file systems
vendor_redhat·2014-12-18·CVSS 9.8
CVE-2014-9390 [CRITICAL] CWE-20 git: arbitrary command execution vulnerability on case-insensitive file systems
git: arbitrary command execution vulnerability on case-insensitive file systems
Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
Statement: This flaw is only exploitable when the local git repository is stored on a case-insensitive filesyst
Debian
CVE-2014-9390: dulwich - Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, ...
vendor_debian·2014·CVSS 9.8
CVE-2014-9390 [CRITICAL] CVE-2014-9390: dulwich - Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, ...
Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
Scope: local
bookworm: resolved (fixed in 0.10.1-1)
bullseye: resolved (fixed in 0.10.1-1)
forky: resolved (fixed in 0.10.1-1)
sid: resolved (fixed in 0.10.1-1)
trixie: resolved (fixed in 0.10.
Apple
CVE-2014-9390: Xcode 6.2
vendor_apple·CVSS 9.8
CVE-2014-9390 [CRITICAL] CVE-2014-9390: Xcode 6.2
Apple Security Update: About the security content of Xcode 6.2
Product: Xcode
Version: 6.2
CVE: CVE-2014-9390
Component: CVE-ID
No detection rules found.
Exploit-DB
GIT 1.8.5.6/1.9.5/2.0.5/2.1.4/2.2.1 & Mercurial < 3.2.3 - Multiple Vulnerabilities (Metasploit)
exploitdb·2014-12-18·CVSS 9.8
CVE-2013-0758 [CRITICAL] GIT 1.8.5.6/1.9.5/2.0.5/2.1.4/2.2.1 & Mercurial < 3.2.3 - Multiple Vulnerabilities (Metasploit)
GIT 1.8.5.6/1.9.5/2.0.5/2.1.4/2.2.1 & Mercurial 'Malicious Git and Mercurial HTTP Server For CVE-2014-9390',
'Description' => %q(
This module exploits CVE-2014-9390, which affects Git (versions less
than 1.8.5.6, 1.9.5, 2.0.5, 2.1.4 and 2.2.1) and Mercurial (versions
less than 3.2.3) and describes three vulnerabilities.
On operating systems which have case-insensitive file systems, like
Windows and OS X, Git clients can be convinced to retrieve and
overwrite sensitive configuration files in the .git
directory which can allow arbitrary code execution if a vulnerable
client can be convinced to perform certain actions (for example,
a checkout) against a malicious Git repository.
A second vulnerability with similar characteristics also exists in both
Git and Mercurial clients, on HFS+ file sys
Metasploit
Malicious Git and Mercurial HTTP Server For CVE-2014-9390
metasploit·CVSS 9.8
CVE-2014-9390 [CRITICAL] Malicious Git and Mercurial HTTP Server For CVE-2014-9390
Malicious Git and Mercurial HTTP Server For CVE-2014-9390
This module exploits CVE-2014-9390, which affects Git (versions less than 1.8.5.6, 1.9.5, 2.0.5, 2.1.4 and 2.2.1) and Mercurial (versions less than 3.2.3) and describes three vulnerabilities. On operating systems which have case-insensitive file systems, like Windows and OS X, Git clients can be convinced to retrieve and overwrite sensitive configuration files in the .git directory which can allow arbitrary code execution if a vulnerable client can be convinced to perform certain actions (for example, a checkout) against a malicious Git repository. A second vulnerability with similar characteristics also exists in both Git and Mercurial clients, on HFS+ file systems (Mac OS X) only, where certain Unicode codepoints are ignorable. T
arXiv
Unsafe at Any Copy: Name Collisions from Mixing Case Sensitivities
arxiv_fulltext·2022-11-30·CVSS 8.0
[HIGH] Unsafe at Any Copy: Name Collisions from Mixing Case Sensitivities
Unsafe at Any Copy: Name Collisions from Mixing Case Sensitivities
*
Aditya Basu
[email protected]
John Sampson
[email protected]
Zhiyun Qian
[email protected]
Trent Jaeger
[email protected]
The Pennsylvania State University
University of California, Riverside
## Abstract
File name confusion attacks, such as malicious symlinks and file squatting, have long been studied as sources of security vulnerabilities. However, a recently emerged type, i.e., case-sensitivity-induced name collisions, has not been scrutinized.
These collisions are introduced by differences in name resolution under case-sensitive and case-insensitive file systems or directories.
A prominent example is the recent Git vulnerability (CVE-2021-21300) which can lead to code execution on a victim client when it clone
Bugzilla
CVE-2014-9390 git: arbitrary command execution vulnerability on case-insensitive file systems
bugzilla·2014-12-19·CVSS 9.8
CVE-2014-9390 [CRITICAL] CVE-2014-9390 git: arbitrary command execution vulnerability on case-insensitive file systems
CVE-2014-9390 git: arbitrary command execution vulnerability on case-insensitive file systems
It was reported [1] that git, when used as a client on a case-insensitive filesystem (such as FAT, FAT32, NTFS, HFS+, etc.), could allow the overwrite of the .git/config file when the client performed a "git pull". Because git permitted committing .Git/config (or any case variation), on the pull this would replace the user's .git/config. If this malicious config file contained defined external commands (such as for invoking and editor or an external diff utility) it could allow for the execution of arbitrary code with the privileges of the user running the git client.
[1] http://article.gmane.org/gmane.linux.kernel/1853266
Statement:
This flaw is only exploitable when the local git repository
http://article.gmane.org/gmane.linux.kernel/1853266http://git-blame.blogspot.com/2014/12/git-1856-195-205-214-and-221-and.htmlhttp://mercurial.selenic.com/wiki/WhatsNewhttp://securitytracker.com/id?1031404http://support.apple.com/kb/HT204147https://github.com/blog/1938-git-client-vulnerability-announcedhttps://github.com/libgit2/libgit2/commit/928429c5c96a701bcbcafacb2421a82602b36915https://libgit2.org/security/https://news.ycombinator.com/item?id=8769667http://article.gmane.org/gmane.linux.kernel/1853266http://git-blame.blogspot.com/2014/12/git-1856-195-205-214-and-221-and.htmlhttp://mercurial.selenic.com/wiki/WhatsNewhttp://securitytracker.com/id?1031404http://support.apple.com/kb/HT204147https://github.com/blog/1938-git-client-vulnerability-announcedhttps://github.com/libgit2/libgit2/commit/928429c5c96a701bcbcafacb2421a82602b36915https://libgit2.org/security/https://news.ycombinator.com/item?id=8769667
2020-02-12
Published