Debian git-core DEC Alpha & MIPS Local Privilege Escalation Vulnerability

Bugtraq ID:	34644
Class:	Access Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Apr 21 2009 12:00AM
Updated:	Apr 21 2009 11:26PM
Credit:	Peter Palfrader
Vulnerable:	Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 alpha Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 alpha Debian git-core 1.5.6 5-3 Debian git-core 1.4.4 4-4
Not Vulnerable:

Debian git-core DEC Alpha & MIPS Local Privilege Escalation Vulnerability

The Debian 'git-core' package is prone to a local privilege-escalation vulnerability because it fails to sufficiently validate user-supplied data.

An attacker can exploit this issue to execute arbitrary commands with superuser privileges. Successfully exploiting this issue will result in the complete compromise of affected computers.

This issue affects only DEC Alpha and MIPS architectures.

Debian git-core DEC Alpha & MIPS Local Privilege Escalation Vulnerability

To exploit this issue, attackers need local access and readily available tools.

Debian git-core DEC Alpha & MIPS Local Privilege Escalation Vulnerability

Solution:
The vendor has released updates. Please see the references for more information.


Debian Linux 4.0 mipsel

• Debian git-arch_1.4.4.4-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-arch_1.4.4 .4-4+etch1_all.deb


• Debian git-arch_1.4.4.4-4+etch2_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-arch_1.4.4 .4-4+etch2_all.deb


• Debian git-core_1.4.4.4-2.1+etch1_mipsel.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4 .4-2.1+etch1_mipsel.deb


• Debian git-core_1.4.4.4-4+etch1_mipsel.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4 .4-4+etch1_mipsel.deb


• Debian git-core_1.4.4.4-4+etch2_mipsel.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4 .4-4+etch2_mipsel.deb


• Debian git-cvs_1.4.4.4-2.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-cvs_1.4.4. 4-2.1+etch1_all.deb


• Debian git-cvs_1.4.4.4-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-cvs_1.4.4. 4-4+etch1_all.deb


• Debian git-cvs_1.4.4.4-4+etch2_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-cvs_1.4.4. 4-4+etch2_all.deb


• Debian git-daemon-run_1.4.4.4-2.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-daemon-run _1.4.4.4-2.1+etch1_all.deb


• Debian git-daemon-run_1.4.4.4-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-daemon-run _1.4.4.4-4+etch1_all.deb


• Debian git-daemon-run_1.4.4.4-4+etch2_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-daemon-run _1.4.4.4-4+etch2_all.deb


• Debian git-doc_1.4.4.4-2.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-doc_1.4.4. 4-2.1+etch1_all.deb


• Debian git-doc_1.4.4.4-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-doc_1.4.4. 4-4+etch1_all.deb


• Debian git-doc_1.4.4.4-4+etch2_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-doc_1.4.4. 4-4+etch2_all.deb


• Debian git-email_1.4.4.4-2.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-email_1.4. 4.4-2.1+etch1_all.deb


• Debian git-email_1.4.4.4-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-email_1.4. 4.4-4+etch1_all.deb


• Debian git-email_1.4.4.4-4+etch2_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-email_1.4. 4.4-4+etch2_all.deb


• Debian git-svn_1.4.4.4-2.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-svn_1.4.4. 4-2.1+etch1_all.deb


• Debian git-svn_1.4.4.4-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-svn_1.4.4. 4-4+etch1_all.deb


• Debian git-svn_1.4.4.4-4+etch2_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-svn_1.4.4. 4-4+etch2_all.deb


• Debian gitk_1.4.4.4-2.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/gitk_1.4.4.4-2 .1+etch1_all.deb


• Debian gitk_1.4.4.4-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/gitk_1.4.4.4-4 +etch1_all.deb


• Debian gitk_1.4.4.4-4+etch2_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/gitk_1.4.4.4-4 +etch2_all.deb


• Debian gitweb_1.4.4.4-2.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/gitweb_1.4.4.4 -2.1+etch1_all.deb


• Debian gitweb_1.4.4.4-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/gitweb_1.4.4.4 -4+etch1_all.deb


• Debian gitweb_1.4.4.4-4+etch2_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/gitweb_1.4.4.4 -4+etch2_all.deb

Debian Linux 5.0 alpha

• Debian git-arch_1.5.6.5-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-arch_1.5.6 .5-3+lenny1_all.deb


• Debian git-core_1.5.6.5-3+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-core_1.5.6 .5-3+lenny1_alpha.deb


• Debian git-cvs_1.5.6.5-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-cvs_1.5.6. 5-3+lenny1_all.deb


• Debian git-daemon-run_1.5.6.5-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-daemon-run _1.5.6.5-3+lenny1_all.deb


• Debian git-doc_1.5.6.5-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-doc_1.5.6. 5-3+lenny1_all.deb


• Debian git-email_1.5.6.5-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-email_1.5. 6.5-3+lenny1_all.deb


• Debian git-gui_1.5.6.5-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-gui_1.5.6. 5-3+lenny1_all.deb


• Debian git-svn_1.5.6.5-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-svn_1.5.6. 5-3+lenny1_all.deb


• Debian gitk_1.5.6.5-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/gitk_1.5.6.5-3 +lenny1_all.deb


• Debian gitweb_1.5.6.5-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/gitweb_1.5.6.5 -3+lenny1_all.deb

Debian Linux 5.0 mipsel

• Debian git-arch_1.5.6.5-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-arch_1.5.6 .5-3+lenny1_all.deb


• Debian git-core_1.5.6.5-3+lenny1_mipsel.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-core_1.5.6 .5-3+lenny1_mipsel.deb


• Debian git-cvs_1.5.6.5-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-cvs_1.5.6. 5-3+lenny1_all.deb


• Debian git-daemon-run_1.5.6.5-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-daemon-run _1.5.6.5-3+lenny1_all.deb


• Debian git-doc_1.5.6.5-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-doc_1.5.6. 5-3+lenny1_all.deb


• Debian git-email_1.5.6.5-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-email_1.5. 6.5-3+lenny1_all.deb


• Debian git-gui_1.5.6.5-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-gui_1.5.6. 5-3+lenny1_all.deb


• Debian git-svn_1.5.6.5-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-svn_1.5.6. 5-3+lenny1_all.deb


• Debian gitk_1.5.6.5-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/gitk_1.5.6.5-3 +lenny1_all.deb


• Debian gitweb_1.5.6.5-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/gitweb_1.5.6.5 -3+lenny1_all.deb

Debian Linux 4.0 alpha

• Debian git-arch_1.4.4.4-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-arch_1.4.4 .4-4+etch1_all.deb


• Debian git-arch_1.4.4.4-4+etch2_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-arch_1.4.4 .4-4+etch2_all.deb


• Debian git-core_1.4.4.4-2.1+etch1_alpha.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4 .4-2.1+etch1_alpha.deb


• Debian git-core_1.4.4.4-4+etch1_alpha.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4 .4-4+etch1_alpha.deb


• Debian git-core_1.4.4.4-4+etch2_alpha.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4 .4-4+etch2_alpha.deb


• Debian git-cvs_1.4.4.4-2.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-cvs_1.4.4. 4-2.1+etch1_all.deb


• Debian git-cvs_1.4.4.4-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-cvs_1.4.4. 4-4+etch1_all.deb


• Debian git-cvs_1.4.4.4-4+etch2_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-cvs_1.4.4. 4-4+etch2_all.deb


• Debian git-daemon-run_1.4.4.4-2.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-daemon-run _1.4.4.4-2.1+etch1_all.deb


• Debian git-daemon-run_1.4.4.4-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-daemon-run _1.4.4.4-4+etch1_all.deb


• Debian git-daemon-run_1.4.4.4-4+etch2_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-daemon-run _1.4.4.4-4+etch2_all.deb


• Debian git-doc_1.4.4.4-2.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-doc_1.4.4. 4-2.1+etch1_all.deb


• Debian git-doc_1.4.4.4-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-doc_1.4.4. 4-4+etch1_all.deb


• Debian git-doc_1.4.4.4-4+etch2_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-doc_1.4.4. 4-4+etch2_all.deb


• Debian git-email_1.4.4.4-2.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-email_1.4. 4.4-2.1+etch1_all.deb


• Debian git-email_1.4.4.4-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-email_1.4. 4.4-4+etch1_all.deb


• Debian git-email_1.4.4.4-4+etch2_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-email_1.4. 4.4-4+etch2_all.deb


• Debian git-svn_1.4.4.4-2.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-svn_1.4.4. 4-2.1+etch1_all.deb


• Debian git-svn_1.4.4.4-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-svn_1.4.4. 4-4+etch1_all.deb


• Debian git-svn_1.4.4.4-4+etch2_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-svn_1.4.4. 4-4+etch2_all.deb


• Debian gitk_1.4.4.4-2.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/gitk_1.4.4.4-2 .1+etch1_all.deb


• Debian gitk_1.4.4.4-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/gitk_1.4.4.4-4 +etch1_all.deb


• Debian gitk_1.4.4.4-4+etch2_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/gitk_1.4.4.4-4 +etch2_all.deb


• Debian gitweb_1.4.4.4-2.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/gitweb_1.4.4.4 -2.1+etch1_all.deb


• Debian gitweb_1.4.4.4-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/gitweb_1.4.4.4 -4+etch1_all.deb


• Debian gitweb_1.4.4.4-4+etch2_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/gitweb_1.4.4.4 -4+etch2_all.deb

Debian Linux 5.0 mips

• Debian git-arch_1.5.6.5-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-arch_1.5.6 .5-3+lenny1_all.deb


• Debian git-core_1.5.6.5-3+lenny1_mips.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-core_1.5.6 .5-3+lenny1_mips.deb


• Debian git-cvs_1.5.6.5-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-cvs_1.5.6. 5-3+lenny1_all.deb


• Debian git-daemon-run_1.5.6.5-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-daemon-run _1.5.6.5-3+lenny1_all.deb


• Debian git-doc_1.5.6.5-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-doc_1.5.6. 5-3+lenny1_all.deb


• Debian git-email_1.5.6.5-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-email_1.5. 6.5-3+lenny1_all.deb


• Debian git-gui_1.5.6.5-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-gui_1.5.6. 5-3+lenny1_all.deb


• Debian git-svn_1.5.6.5-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-svn_1.5.6. 5-3+lenny1_all.deb


• Debian gitk_1.5.6.5-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/gitk_1.5.6.5-3 +lenny1_all.deb


• Debian gitweb_1.5.6.5-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/gitweb_1.5.6.5 -3+lenny1_all.deb

Debian Linux 4.0 mips

• Debian git-arch_1.4.4.4-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-arch_1.4.4 .4-4+etch1_all.deb


• Debian git-arch_1.4.4.4-4+etch2_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-arch_1.4.4 .4-4+etch2_all.deb


• Debian git-core_1.4.4.4-2.1+etch1_mips.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4 .4-2.1+etch1_mips.deb


• Debian git-core_1.4.4.4-4+etch1_mips.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4 .4-4+etch1_mips.deb


• Debian git-core_1.4.4.4-4+etch2_mips.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-core_1.4.4 .4-4+etch2_mips.deb


• Debian git-cvs_1.4.4.4-2.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-cvs_1.4.4. 4-2.1+etch1_all.deb


• Debian git-cvs_1.4.4.4-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-cvs_1.4.4. 4-4+etch1_all.deb


• Debian git-cvs_1.4.4.4-4+etch2_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-cvs_1.4.4. 4-4+etch2_all.deb


• Debian git-daemon-run_1.4.4.4-2.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-daemon-run _1.4.4.4-2.1+etch1_all.deb


• Debian git-daemon-run_1.4.4.4-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-daemon-run _1.4.4.4-4+etch1_all.deb


• Debian git-daemon-run_1.4.4.4-4+etch2_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-daemon-run _1.4.4.4-4+etch2_all.deb


• Debian git-doc_1.4.4.4-2.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-doc_1.4.4. 4-2.1+etch1_all.deb


• Debian git-doc_1.4.4.4-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-doc_1.4.4. 4-4+etch1_all.deb


• Debian git-doc_1.4.4.4-4+etch2_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-doc_1.4.4. 4-4+etch2_all.deb


• Debian git-email_1.4.4.4-2.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-email_1.4. 4.4-2.1+etch1_all.deb


• Debian git-email_1.4.4.4-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-email_1.4. 4.4-4+etch1_all.deb


• Debian git-email_1.4.4.4-4+etch2_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-email_1.4. 4.4-4+etch2_all.deb


• Debian git-svn_1.4.4.4-2.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-svn_1.4.4. 4-2.1+etch1_all.deb


• Debian git-svn_1.4.4.4-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-svn_1.4.4. 4-4+etch1_all.deb


• Debian git-svn_1.4.4.4-4+etch2_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/git-svn_1.4.4. 4-4+etch2_all.deb


• Debian gitk_1.4.4.4-2.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/gitk_1.4.4.4-2 .1+etch1_all.deb


• Debian gitk_1.4.4.4-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/gitk_1.4.4.4-4 +etch1_all.deb


• Debian gitk_1.4.4.4-4+etch2_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/gitk_1.4.4.4-4 +etch2_all.deb


• Debian gitweb_1.4.4.4-2.1+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/gitweb_1.4.4.4 -2.1+etch1_all.deb


• Debian gitweb_1.4.4.4-4+etch1_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/gitweb_1.4.4.4 -4+etch1_all.deb


• Debian gitweb_1.4.4.4-4+etch2_all.deb
  http://security.debian.org/pool/updates/main/g/git-core/gitweb_1.4.4.4 -4+etch2_all.deb

Debian git-core DEC Alpha & MIPS Local Privilege Escalation Vulnerability

References:

• Debian Homepage (Debian)