CVE-2010-2542: Buffer Overflow
A buffer overrun was found in the way Git sanitized path of a git directory. If a local attacker would create a specially-crafted working copy and trick the local user into running any git command, it could lead to arbitrary code execution with the privileges of the user running the Git command.
References: [1] http://seclists.org/oss-sec/2010/q3/93 [2] https://bugzilla.redhat.com/showbug.cgi?id=617422
Upstream patches: [3] http://git.kernel.org/?p=git/git.git;a=commitdiff;h=3c9d0414ed2db0167e6c828b547be8fc9f88fccc;hp=c173dad58787a7f11a526dbcdaa5a2fe9ff1c87f [4] http://git.kernel.org/?p=git/git.git;a=commitdiff;h=b44ebb19e3234c5dffe9869ceac5408bb44c2e20;hp=2a5fe2545882721d6841bad11dae0f15b454bf0d
Other sources
Stack-based buffer overflow in the isgitdirectory function in setup.c in Git before 1.7.2.1 allows local users to gain privileges via a long gitdir: field in a .git file in a working copy.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2542?
CVE-2010-2542 has a high severity rating due to its potential for arbitrary code execution.
How do I fix CVE-2010-2542?
To fix CVE-2010-2542, update Git to a version later than 1.7.2.1.
Who is affected by CVE-2010-2542?
CVE-2010-2542 affects local users running vulnerable versions of Git on their systems.
What type of vulnerability is CVE-2010-2542?
CVE-2010-2542 is classified as a buffer overrun vulnerability.
What can an attacker achieve with CVE-2010-2542?
An attacker can execute arbitrary code with the privileges of the user running the vulnerable Git command.