git: git-daemon Denial of Service

{"result": {"cve": [{"id": "CVE-2009-2108", "type": "cve", "title": "CVE-2009-2108", "description": "git-daemon in git 1.4.4.5 through 1.6.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a request containing extra unrecognized arguments.", "published": "2009-06-18T14:30:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-2108", "cvelist": ["CVE-2009-2108"], "lastseen": "2016-09-03T12:31:37"}], "nessus": [{"id": "FEDORA_2009-6839.NASL", "type": "nessus", "title": "Fedora 10 : git-1.6.0.6-4.fc10 (2009-6839)", "description": "This update fixes a Denial of Service vulnerability in git-daemon. It also fixes minor issues when using git-cvsimport and the formatting of the git-daemon xinetd service description.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2009-06-25T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=39509", "cvelist": ["CVE-2009-2108"], "lastseen": "2016-09-26T17:23:18"}, {"id": "FEDORA_2009-6809.NASL", "type": "nessus", "title": "Fedora 9 : git-1.6.0.6-4.fc9 (2009-6809)", "description": "This update fixes a Denial of Service vulnerability in git-daemon. It also fixes minor issues when using git-cvsimport and the formatting of the git-daemon xinetd service description.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2009-06-25T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=39507", "cvelist": ["CVE-2009-2108"], "lastseen": "2016-09-26T17:24:37"}, {"id": "MANDRIVA_MDVSA-2009-155.NASL", "type": "nessus", "title": "Mandriva Linux Security Advisory : git (MDVSA-2009:155)", "description": "A vulnerability has been found and corrected in git :\n\ngit-daemon in git 1.4.4.5 through 1.6.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a request containing extra unrecognized arguments (CVE-2009-2108).\n\nThis update provides fixes for this vulnerability.", "published": "2010-07-30T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=48150", "cvelist": ["CVE-2009-2108"], "lastseen": "2016-09-26T17:25:06"}, {"id": "FREEBSD_PKG_D9B01C0859B311DE828E00E0815B8DA8.NASL", "type": "nessus", "title": "FreeBSD : git -- denial of service vulnerability (d9b01c08-59b3-11de-828e-00e0815b8da8)", "description": "SecurityFocus reports :\n\nGit is prone to a denial-of-service vulnerability because it fails to properly handle some client requests.\n\nAttackers can exploit this issue to cause a daemon process to enter an infinite loop. Repeated exploits may consume excessive system resources, resulting in a denial of service condition.", "published": "2009-06-16T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=39408", "cvelist": ["CVE-2009-2108"], "lastseen": "2016-09-26T17:26:20"}, {"id": "FEDORA_2009-6936.NASL", "type": "nessus", "title": "Fedora 11 : git-1.6.2.5-1.fc11 (2009-6936)", "description": "This update fixes a Denial of Service vulnerability in git-daemon.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2009-06-25T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=39513", "cvelist": ["CVE-2009-2108"], "lastseen": "2016-09-26T17:24:39"}, {"id": "GENTOO_GLSA-200907-05.NASL", "type": "nessus", "title": "GLSA-200907-05 : git: git-daemon Denial of Service", "description": "The remote host is affected by the vulnerability described in GLSA-200907-05 (git: git-daemon Denial of Service)\n\n Shawn O. Pearce reported that git-daemon runs into an infinite loop when handling requests that contain unrecognized arguments.\n Impact :\n\n A remote unauthenticated attacker could send a specially crafted request to git-daemon, possibly leading to a Denial of Service (CPU consumption).\n Workaround :\n\n There is no known workaround at this time.", "published": "2009-07-13T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=39776", "cvelist": ["CVE-2009-2108"], "lastseen": "2016-09-26T17:26:03"}, {"id": "DEBIAN_DSA-1841.NASL", "type": "nessus", "title": "Debian DSA-1841-1 : git-core - denial of service", "description": "It was discovered that git-daemon which is part of git-core, a popular distributed revision control system, is vulnerable to denial of service attacks caused by a programming mistake in handling requests containing extra unrecognized arguments which results in an infinite loop. While this is no problem for the daemon itself as every request will spawn a new git-daemon instance, this still results in a very high CPU consumption and might lead to denial of service conditions.", "published": "2010-02-24T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=44706", "cvelist": ["CVE-2009-2108"], "lastseen": "2016-09-26T17:26:38"}], "exploitdb": [{"id": "EDB-ID:33036", "type": "exploitdb", "title": "Git <= 1.6.3 Parameter Processing Remote Denial Of Service Vulnerability", "description": "Git 1.6.3 Parameter Processing Remote Denial Of Service Vulnerability. CVE-2009-2108. Dos exploit for linux platform", "published": "2009-05-05T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://www.exploit-db.com/exploits/33036/", "cvelist": ["CVE-2009-2108"], "lastseen": "2016-02-03T18:20:33"}], "openvas": [{"id": "OPENVAS:64292", "type": "openvas", "title": "Fedora Core 10 FEDORA-2009-6839 (git)", "description": "The remote host is missing an update to git\nannounced via advisory FEDORA-2009-6839.", "published": "2009-06-30T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=64292", "cvelist": ["CVE-2009-2108"], "lastseen": "2016-12-12T15:25:20"}, {"id": "OPENVAS:64290", "type": "openvas", "title": "Fedora Core 11 FEDORA-2009-6936 (git)", "description": "The remote host is missing an update to git\nannounced via advisory FEDORA-2009-6936.", "published": "2009-06-30T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=64290", "cvelist": ["CVE-2009-2108"], "lastseen": "2016-12-12T15:25:30"}, {"id": "OPENVAS:66803", "type": "openvas", "title": "Debian Security Advisory DSA 1841-2 (git-core)", "description": "The remote host is missing an update to git-core\nannounced via advisory DSA 1841-2.", "published": "2010-02-10T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=66803", "cvelist": ["CVE-2009-2108"], "lastseen": "2017-02-10T09:01:47"}, {"id": "OPENVAS:64202", "type": "openvas", "title": "FreeBSD Ports: git", "description": "The remote host is missing an update to the system\nas announced in the referenced advisory.", "published": "2009-06-15T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=64202", "cvelist": ["CVE-2009-2108"], "lastseen": "2016-12-27T14:02:56"}, {"id": "OPENVAS:64519", "type": "openvas", "title": "Mandrake Security Advisory MDVSA-2009:176 (git)", "description": "The remote host is missing an update to git\nannounced via advisory MDVSA-2009:176.", "published": "2009-08-17T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=64519", "cvelist": ["CVE-2009-2108"], "lastseen": "2017-01-25T11:02:12"}, {"id": "OPENVAS:64457", "type": "openvas", "title": "Mandrake Security Advisory MDVSA-2009:155 (git)", "description": "The remote host is missing an update to git\nannounced via advisory MDVSA-2009:155.", "published": "2009-07-29T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=64457", "cvelist": ["CVE-2009-2108"], "lastseen": "2017-01-25T11:02:07"}, {"id": "OPENVAS:64480", "type": "openvas", "title": "Debian Security Advisory DSA 1841-1 (git-core)", "description": "The remote host is missing an update to git-core\nannounced via advisory DSA 1841-1.", "published": "2009-07-29T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=64480", "cvelist": ["CVE-2009-2108"], "lastseen": "2016-11-29T12:45:56"}, {"id": "OPENVAS:64288", "type": "openvas", "title": "Fedora Core 9 FEDORA-2009-6809 (git)", "description": "The remote host is missing an update to git\nannounced via advisory FEDORA-2009-6809.", "published": "2009-06-30T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=64288", "cvelist": ["CVE-2009-2108"], "lastseen": "2016-12-12T15:25:25"}, {"id": "OPENVAS:64427", "type": "openvas", "title": "Gentoo Security Advisory GLSA 200907-05 (git)", "description": "The remote host is missing updates announced in\nadvisory GLSA 200907-05.", "published": "2009-07-29T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=64427", "cvelist": ["CVE-2009-2108"], "lastseen": "2017-01-25T11:02:17"}], "seebug": [{"id": "SSV-86291", "type": "seebug", "title": "Git <= 1.6.3 Parameter Processing Remote Denial Of Service Vulnerability", "description": "Summary: \ngit 1.4.4. 5 version to 1. 6. 3 version of git-daemon, a remote attacker can use an included extra that the argument of the request, causing a denial of service(infinite loop and CPU loss).\n", "published": "2014-07-01T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://www.seebug.org/vuldb/ssvid-86291", "cvelist": ["CVE-2009-2108"], "lastseen": "2016-07-26T19:43:27"}], "freebsd": [{"id": "D9B01C08-59B3-11DE-828E-00E0815B8DA8", "type": "freebsd", "title": "git -- denial of service vulnerability", "description": "\nSecurityFocus reports:\n\nGit is prone to a denial-of-service vulnerability because it\n\t fails to properly handle some client requests.\nAttackers can exploit this issue to cause a daemon process to\n\t enter an infinite loop. Repeated exploits may consume excessive\n\t system resources, resulting in a denial of service condition.\n\n", "published": "2009-06-04T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://vuxml.freebsd.org/freebsd/d9b01c08-59b3-11de-828e-00e0815b8da8.html", "cvelist": ["CVE-2009-2108"], "lastseen": "2016-09-26T17:24:52"}], "debian": [{"id": "DSA-1841", "type": "debian", "title": "git-core -- denial of service", "description": "It was discovered that git-daemon which is part of git-core, a popular distributed revision control system, is vulnerable to denial of service attacks caused by a programming mistake in handling requests containing extra unrecognized arguments which results in an infinite loop. While this is no problem for the daemon itself as every request will spawn a new git-daemon instance, this still results in a very high CPU consumption and might lead to denial of service conditions.\n\nFor the oldstable distribution (etch), this problem has been fixed in version 1.4.4.4-4+etch3.\n\nFor the stable distribution (lenny), this problem has been fixed in version 1.5.6.5-3+lenny2.\n\nFor the testing distribution (squeeze), this problem has been fixed in version 1:1.6.3.3-1.\n\nFor the unstable distribution (sid), this problem has been fixed in version 1:1.6.3.3-1.\n\nWe recommend that you upgrade your git-core packages.", "published": "2009-07-25T00:00:00", "cvss": {"score": 5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "http://www.debian.org/security/dsa-1841", "cvelist": ["CVE-2009-2108"], "lastseen": "2016-09-02T18:24:06"}]}}