U radu programskog paketa Gitolite, distribuiranog s operacijskim sustavom Fedora 14, otkriven je sigurnosni propust. Radi se o alatu koji osigurava pristup git repozitoriju i koji može ograničavati tko može čitati/pisati u repozitorij. Propust je uzrokovan neodgovarajućom obradom ADC naredbi (eng. admin-defined commands). Napadaču nedostatak omogućuje zaobilaženje pojedinih sigurnosnih ograničenja i pokretanje proizvoljnog programskog koda. Svim se korisnicima, u svrhu zaštite, preporuča instalacija odgovarajućih programskih ispravaka.

--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2011-1644
2011-02-16 18:40:08
--------------------------------------------------------------------------------

Name        : gitolite
Product     : Fedora 14
Version     : 1.5.3
Release     : 2.fc14
URL         : http://github.com/sitaramc/gitolite
Summary     : Highly flexible server for git directory version tracker
Description :
Gitolite allows a server to host many git repositories and provide access
to many developers, without having to give them real userids on the server.
The essential magic in doing this is ssh's pubkey access and the authorized
keys file, and the inspiration was an older program called gitosis.

Gitolite can restrict who can read from (clone/fetch) or write to (push) a
repository. It can also restrict who can push to what branch or tag, which
is very important in a corporate environment. Gitolite can be installed
without requiring root permissions, and with no additional software than git
itself and perl. It also has several other neat features described below and
elsewhere in the doc/ directory.

--------------------------------------------------------------------------------
Update Information:

Dylan Alex Simon discovered and reported a directory traversal flaw in the way
Gitolite restricted access to admin defined commands ("ADC"). An authenticated
attacker could execute arbitrary code with privileges of Gitolite server user
using specially crafted command name.

The flaw does not affect default Gitolite installations. Users who have enabled
ADC in their configurations are advised to install the updated package which
includes a fix to resolve the issue.
--------------------------------------------------------------------------------
ChangeLog:

* Tue Feb 15 2011 Lubomir Rintel <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 1.5.3-2
- Fix ADC security issue
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program.  Use 
su -c 'yum update gitolite' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
https://admin.fedoraproject.org/mailman/listinfo/package-announce