Thread Rating:
  • 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
Share Post: Reddit Facebook
Rogue Source Code Repos Can Compromise Mac Security Due to Old Git Version
#1
[Image: rogue-source-code-repos-can-compromise-m...3106-2.jpg]
A researcher has identified a security issue for Apple's Mac operating system, due to an older version of Git that comes bundled with OS X versions.
The problem resides in Git, a version control system (VCS) that allows developers to manage source code repositories, keeping track of code changes from version to version.
Mac versions come bundled with insecure Git versions
Rachel Kroll has discovered that El Capitan comes bundled with an older version of Git that's exposing users to two possible attacks, due to the CVE-2016-2324 and CVE-2016-2315 vulnerabilities present in all Git versions 2.7.3 and prior. El Capitan comes bundled by default with Git 2.6.4.
The two vulnerabilities, both heap-based buffer overflows, allow attackers to execute malicious code on the machine. The only condition for an attack to take place is that a Mac user forks a Git repo that contains malicious code.
The attacker can use the malicious code hidden in the repo to launch an attack on the Mac, compromise the system, and take control of the user's device.
The bundled Git version can't be updated without breaking Git support
Mrs. Kroll says that this particular instance of Git can't be upgraded, nor can users change its runtime permissions to neuter the Git binary's capabilities.
Digging around in El Capitan's backend, she discovered that the "/usr/bin/git" binary is actually a link to a version of Git included with Xcode at "/Applications/Xcode.app/Contents/Developer/usr/bin". Upgrading or changing this binary's permissions breaks Git support.
"If you rely on machines like this, I am truly sorry. I feel for you," Mrs. Kroll wrote on her blog. "I wrote this post in an attempt to goad them [Apple] into action because this is affecting lots of people who are important to me. They are basically screwed until Apple deigns to deliver a patched git unto them."


source
Reply


Possibly Related Threads…
Thread Author Replies Views Last Post
  Vulnerabilities in WatchGuard, Panda Security Products Lead to Code Execution mrtrout 0 423 02-04-2024 , 06:49 AM
Last Post: mrtrout
  TikTok denies security breach after hackers leak user data, source code tarekma7 0 1,879 09-06-2022 , 10:19 AM
Last Post: tarekma7
  Google open-sources Allstar, a tool to protect GitHub repos mrtrout 0 580 08-13-2021 , 07:22 AM
Last Post: mrtrout
  Hackers Steal FIFA 21 Source Code, Tools in EA Breach baziroll 0 779 06-11-2021 , 07:50 PM
Last Post: baziroll
  Hackers accessed Stormshield data, including source code of ANSSI certified products Bjyda 0 1,241 02-04-2021 , 11:48 PM
Last Post: Bjyda

Forum Jump:


Users browsing this thread: 1 Guest(s)