National Cyber-Alert System

Vulnerability Summary for CVE-2008-5916

Overview

gitweb/gitweb.perl in gitweb in Git 1.6.x before 1.6.0.6, 1.5.6.x before 1.5.6.6, 1.5.5.x before 1.5.5.6, 1.5.4.x before 1.5.4.7, and other versions after 1.4.3 allows local repository owners to execute arbitrary commands by modifying the diff.external configuration variable and executing a crafted gitweb query.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: FEDORA

Name: FEDORA-2008-11653

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-December/msg01170.html

External Source: FEDORA

Name: FEDORA-2008-11650

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-December/msg01169.html

External Source: XF

Name: git-gitweb-privilege-escalation(47528)

Hyperlink:http://xforce.iss.net/xforce/xfdb/47528

External Source: UBUNTU

Name: USN-723-1

Hyperlink:http://www.ubuntu.com/usn/USN-723-1

External Source: MLIST

Name: [oss-security] 20090120 Re: CVE request -- git

Hyperlink:http://www.openwall.com/lists/oss-security/2009/01/20/2

External Source: MLIST

Name: [oss-security] 20090115 CVE request -- git

Hyperlink:http://www.openwall.com/lists/oss-security/2009/01/15/2

External Source: GENTOO

Name: GLSA-200903-15

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200903-15.xml

External Source: SREASON

Name: 4922

Hyperlink:http://securityreason.com/securityalert/4922

External Source: SECUNIA

Name: 34194

Hyperlink:http://secunia.com/advisories/34194

External Source: SECUNIA

Name: 33964

Hyperlink:http://secunia.com/advisories/33964

External Source: SECUNIA

Name: 33282

Hyperlink:http://secunia.com/advisories/33282

External Source: OSVDB

Name: 50918

Hyperlink:http://osvdb.org/50918

External Source: MLIST

Name: [linux-kernel] 20081220 [Security] gitweb local privilege escalation (fix)

Hyperlink:http://marc.info/?l=linux-kernel&m=122975564100863&w=2:

External Source: MLIST

Name: [git] 20081220 [Security] gitweb local privilege escalation (fix)

Hyperlink:http://marc.info/?l=git&m=122975564100860&w=2