The remote host is affected by the vulnerability described in GLSA-201509-06 (Git: Arbitrary command execution)

    A vulnerability in Git causing Git-compatible clients that access       case-insensitive or case-normalizing filesystems to overwrite the       .git/config when cloning or checking out a repository, leading to       execution of arbitrary commands.
  Impact :

    An attacker can execute arbitrary commands on a client machine that       clones a crafted malicious Git tree.
  Workaround :

    There is no known workaround at this time.

The git web frontend cgit was updated to 0.11.2 to fix security issues and bugs.

The following vulnerabilities were fixed :

  - CVE-2014-9390: arbitrary command execution vulnerability     on case-insensitive file systems in git. Malicious     commits could affect client users on all platforms using     case-insensitive file systems when using vulnerable git     versions.

In addition cgit was updated to 0.11.2 with minor improvements and bug fixes.

The embedded git version was updated to 2.4.3.

An update of the git package has been released.

The Git Project reports :

When using a case-insensitive filesystem an attacker can craft a malicious Git tree that will cause Git to overwrite its own .git/config file when cloning or checking out a repository, leading to arbitrary command execution in the client machine. If you are a hosting service whose users may fetch from your service to Windows or Mac OS X machines, you are strongly encouraged to update to protect such users who use existing versions of Git.

The version of GitHub for Windows installed on the remote host is prior to 2.6.5. It is, therefore, affected by a command execution vulnerability when processing specially crafted git trees in a case-insensitive or case-normalizing file system. A remote attacker, using a specially crafted git tree, can overwrite a user's '.git/config' file when the user clones or checks out a repository, allowing arbitrary command execution.

The version of Git for Windows (also known as msysGit) installed on the remote host is prior to 1.9.5. It is, therefore, affected by a command execution vulnerability when processing specially crafted git trees in a case-insensitive or case-normalizing file system. A remote attacker, using a specially crafted git tree, can overwrite a user's '.git/config' file when the user clones or checks out a repository, allowing arbitrary command execution.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on     Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all     versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and     JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree     containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config     representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
    (CVE-2014-9390)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Mac OS X host has a version of GitHub prior to 194 installed. It is, therefore, affected by a remote command execution vulnerability when processing git trees in a case-insensitive or case-normalizing file system. A remote attacker, using a specially crafted git tree, can overwrite a user's '.git/config' file when the user clones or checks out a repository, allowing arbitrary command execution.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2470-1 advisory.

    Matt Mackall and Augie Fackler discovered that Git incorrectly handled certain filesystem paths. A remote     attacker could possibly use this issue to execute arbitrary code if the Git tree is stored in an HFS+ or     NTFS filesystem. The remote attacker would need write access to a Git repository that the victim pulls     from.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated git packages fix security vulnerability :

It was reported that git, when used as a client on a case-insensitive filesystem, could allow the overwrite of the .git/config file when the client performed a git pull. Because git permitted committing .Git/config (or any case variation), on the pull this would replace the user's .git/config. If this malicious config file contained defined external commands (such as for invoking and editor or an external diff utility) it could allow for the execution of arbitrary code with the privileges of the user running the git client (CVE-2014-9390).

This update fixes the following security issue :

  - CVE-2014-9390: arbitrary command execution vulnerability     on case-insensitive file system ( bnc#910756)

The Apple Xcode installed on the remote Mac OS X host is prior to version 6.2. It is, therefore, affected by the following vulnerabilities :

  - Numerous errors exist related to the bundled version of Apache Subversion. (CVE-2014-3522, CVE-2014-3528,     CVE-2014-3580, CVE-2014-8108)

  - An error exists related to the bundled version of Git that allows arbitrary files to be added to the .git     folder. (CVE-2014-9390)

libgit2 was updated to fix an arbitrary command execution vulnerability on case-insentitive file systems.

The following vulnerability was fixed :

  - When using programs using libgit2 on case-insensitive     filesystems, .git/config could be overwritten, which     allowed execution of arbitrary commands (boo#925040,     CVE-2014-9390).

The configuration is uncommon as all default file systems on openSUSE are case sensitive.

Additionally, on openSUSE 13.2 libgit2 was updated to version 0.21.5 to backport further critical fixes.

This update fixes the following security issue :

  - CVE-2014-9390: arbitrary command execution vulnerability     on case- insensitive file system (bnc#910756)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201612-19 (Mercurial: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mercurial. Please       review the CVE identifier and bug reports referenced for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process.
  Workaround :

    There is no known workaround at this time.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
86137	GLSA-201509-06 : Git: Arbitrary command execution	Nessus	Gentoo Local Security Checks	2015/9/25	2021/1/11	critical
84335	openSUSE Security Update : cgit (openSUSE-2015-436)	Nessus	SuSE Local Security Checks	2015/6/23	2021/1/19	critical
252274	Photon OS 5.0: Git PHSA-2025-5.0-0590	Nessus	PhotonOS Local Security Checks	2025/8/19	2025/8/23	critical
80148	FreeBSD : git -- Arbitrary command execution on case-insensitive filesystems (1d567278-87a5-11e4-879c-000c292ee6b8)	Nessus	FreeBSD Local Security Checks	2014/12/22	2021/1/6	critical
80202	GitHub for Windows < 2.6.5 .git/config Command Execution	Nessus	Windows	2014/12/22	2018/11/15	medium
80306	Git for Windows .git/config Command Execution	Nessus	Windows	2014/12/30	2018/7/12	medium
252011	Linux Distros Unpatched Vulnerability : CVE-2014-9390	Nessus	Misc.	2025/8/19	2025/8/19	critical
80220	GitHub < 1.9.4 .git/config Command Execution (Mac OS X)	Nessus	MacOS X Local Security Checks	2014/12/23	2018/7/14	medium
80517	Ubuntu 14.04 LTS : Git vulnerability (USN-2470-1)	Nessus	Ubuntu Local Security Checks	2015/1/14	2024/8/28	critical
82422	Mandriva Linux Security Advisory : git (MDVSA-2015:169)	Nessus	Mandriva Local Security Checks	2015/3/30	2021/1/14	high
81064	openSUSE Security Update : git (openSUSE-SU-2015:0159-1)	Nessus	SuSE Local Security Checks	2015/1/29	2021/1/19	critical
81758	Apple Xcode < 6.2 (Mac OS X)	Nessus	MacOS X Local Security Checks	2015/3/11	2020/5/5	medium
82634	openSUSE Security Update : libgit2 (openSUSE-2015-288)	Nessus	SuSE Local Security Checks	2015/4/8	2021/1/19	critical
83671	SUSE SLES12 Security Update : git (SUSE-SU-2015:0100-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/6	critical
95605	GLSA-201612-19 : Mercurial: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2016/12/7	2026/1/15	critical

检测

插件搜索

critical

critical

critical

critical

medium

medium

critical

medium

critical

high

critical

medium

critical

critical

critical