#VU32315 Input validation error in Mercurial - CVE-2015-7545
Vulnerability identifier: #VU32315
Vulnerability risk: High
CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID:
CWE-ID:
CWE-20
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
Mercurial
Client/Desktop applications /
Other client software
Vendor: Mercurial
Description
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule.
Mitigation
Install update from vendor's website.
Vulnerable software versions
Mercurial: 2.3.1 - 2.6.0
External links
https://lists.opensuse.org/opensuse-updates/2015-11/msg00066.html
https://rhn.redhat.com/errata/RHSA-2015-2515.html
https://www.debian.org/security/2016/dsa-3435
https://www.openwall.com/lists/oss-security/2015/12/08/5
https://www.openwall.com/lists/oss-security/2015/12/09/8
https://www.openwall.com/lists/oss-security/2015/12/11/7
https://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
https://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
https://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
https://www.securityfocus.com/bid/78711
https://www.securitytracker.com/id/1034501
https://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.533255
https://www.ubuntu.com/usn/USN-2835-1
https://bugzilla.redhat.com/show_bug.cgi?id=1269794
https://github.com/git/git/blob/master/Documentation/RelNotes/2.3.10.txt
https://github.com/git/git/blob/master/Documentation/RelNotes/2.4.10.txt
https://github.com/git/git/blob/master/Documentation/RelNotes/2.5.4.txt
https://github.com/git/git/blob/master/Documentation/RelNotes/2.6.1.txt
https://kernel.googlesource.com/pub/scm/git/git/+/33cfccbbf35a56e190b79bdec5c85457c952a021
https://lkml.org/lkml/2015/10/5/683
https://security.gentoo.org/glsa/201605-01
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
