Oracle Linux: CVE-2017-1000117: ELSA-2017-2485: git security update (IMPORTANT) (Multiple Advisories)
Description
A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability. A shell command injection flaw related to the handling of "ssh" URLs has been discovered in Git. An attacker could use this flaw to execute shell commands with the privileges of the user running the Git client, for example, when performing a "clone" action on a malicious repository or a legitimate repository containing a malicious commit.
Solution(s)
- oracle-linux-upgrade-emacs-git
- oracle-linux-upgrade-emacs-git-el
- oracle-linux-upgrade-git
- oracle-linux-upgrade-git-all
- oracle-linux-upgrade-git-bzr
- oracle-linux-upgrade-git-cvs
- oracle-linux-upgrade-git-daemon
- oracle-linux-upgrade-git-email
- oracle-linux-upgrade-git-gui
- oracle-linux-upgrade-git-hg
- oracle-linux-upgrade-gitk
- oracle-linux-upgrade-git-p4
- oracle-linux-upgrade-git-svn
- oracle-linux-upgrade-gitweb
- oracle-linux-upgrade-perl-git
- oracle-linux-upgrade-perl-git-svn
- Lightweight Endpoint Agent
- Live Dashboards
- Real Risk Prioritization
- IT-Integrated Remediation Projects
- Cloud, Virtual, and Container Assessment
- Integrated Threat Feeds
- Easy-to-Use RESTful API
- Automation-Assisted Patching
- Automated Containment
With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.
– Scott Cheney, Manager of Information Security, Sierra View Medical Center