CVE-2011-1572: Path Traversal
First published: Tue Apr 12 2011(Updated: )
A flaw was found in the gitolite ADC (Admin Defined Commands) system [1]. If the ADC feature were enabled, a remote user could connect to gitolite and execute arbitrary commands by specifying a command such as "../../../../usr/bin/foo" because gitolite did not filter command names. This has been corrected upstream [2] in version 1.5.9.1 and gitolite will now refuse to execute any commands with ".." in the supplied command name. Note that ADC is only enabled when GL_ADC_PATH is set in the rc file (it is not enabled or set by default) and both the documentation and example rc file note that there are security risks involved with using ADC. [1] <a href="http://groups.google.com/group/gitolite/browse_thread/thread/797a93ec26e1dcbc?pli=1">http://groups.google.com/group/gitolite/browse_thread/thread/797a93ec26e1dcbc?pli=1</a> [2] <a href="https://github.com/sitaramc/gitolite/commit/4ce00aef84d1ff7c35f7adbbb99a6241cfda00cc">https://github.com/sitaramc/gitolite/commit/4ce00aef84d1ff7c35f7adbbb99a6241cfda00cc</a>
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Gitolite | <=1.5.9 | |
| Gitolite | =0.50 | |
| Gitolite | =0.55 | |
| Gitolite | =0.60 | |
| Gitolite | =0.65 | |
| Gitolite | =0.70 | |
| Gitolite | =0.80 | |
| Gitolite | =0.85 | |
| Gitolite | =0.90 | |
| Gitolite | =0.95 | |
| Gitolite | =1.0 | |
| Gitolite | =1.0-rc1 | |
| Gitolite | =1.1 | |
| Gitolite | =1.2 | |
| Gitolite | =1.3 | |
| Gitolite | =1.4 | |
| Gitolite | =1.4.1 | |
| Gitolite | =1.4.2 | |
| Gitolite | =1.5 | |
| Gitolite | =1.5.1 | |
| Gitolite | =1.5.2 | |
| Gitolite | =1.5.3 | |
| Gitolite | =1.5.4 | |
| Gitolite | =1.5.5 | |
| Gitolite | =1.5.6 | |
| Gitolite | =1.5.7 | |
| Gitolite | =1.5.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=695568
- http://www.securityfocus.com/bid/46473
- http://seclists.org/oss-sec/2011/q2/197
- http://seclists.org/oss-sec/2011/q2/209
- https://github.com/sitaramc/gitolite/commit/4ce00aef84d1ff7c35f7adbbb99a6241cfda00cc
- http://www.debian.org/security/2011/dsa-2215
- http://groups.google.com/group/gitolite/browse_thread/thread/797a93ec26e1dcbc?pli=1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/65542
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=695569
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=695570
Frequently Asked Questions
What is the severity of CVE-2011-1572?
CVE-2011-1572 is considered a high-severity vulnerability due to the potential for remote code execution.
How do I fix CVE-2011-1572?
To fix CVE-2011-1572, update Gitolite to the latest version that does not contain this flaw.
What versions are affected by CVE-2011-1572?
CVE-2011-1572 affects Gitolite versions up to and including 1.5.9 and several specific versions from 0.50 to 1.5.8.
What type of vulnerability is CVE-2011-1572?
CVE-2011-1572 is classified as a command injection vulnerability that allows remote execution of arbitrary commands.
Who can exploit CVE-2011-1572?
Any remote user with access to the Gitolite server can exploit CVE-2011-1572 if the Admin Defined Commands feature is enabled.
- agent/references
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/severity
- agent/remedy
- agent/weakness
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-1572
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/gitolite
- canonical/gitolite
- version/gitolite/1.5.9
- version/gitolite/0.50
- version/gitolite/0.55
- version/gitolite/0.60
- version/gitolite/0.65
- version/gitolite/0.70
- version/gitolite/0.80
- version/gitolite/0.85
- version/gitolite/0.90
- version/gitolite/0.95
- version/gitolite/1.0
- version/gitolite/1.0-rc1
- version/gitolite/1.1
- version/gitolite/1.2
- version/gitolite/1.3
- version/gitolite/1.4
- version/gitolite/1.4.1
- version/gitolite/1.4.2
- version/gitolite/1.5
- version/gitolite/1.5.1
- version/gitolite/1.5.2
- version/gitolite/1.5.3
- version/gitolite/1.5.4
- version/gitolite/1.5.5
- version/gitolite/1.5.6
- version/gitolite/1.5.7
- version/gitolite/1.5.8