Remote code execution, git, and OS X

Re:Remote code execution, git, and OS X by yelnatz on Monday April 18, 2016 @02:45AM (#11518105)

How do I replace /usr/bin/git?

I got the updated brew version downloaded already.

[ Parent | on HN ]

Re:Remote code execution, git, and OS X by dchest on Monday April 18, 2016 @02:46AM (#11518113)

This is in the linked post.

Do this to disable it:

    sudo chmod -x /Applications/Xcode.app/Contents/Developer/usr/bin/git

[ Parent | on HN ]

Re:Remote code execution, git, and OS X by bertan on Monday April 18, 2016 @04:45AM (#11518510)

  sudo cp /Applications/Xcode.app/Contents/Developer/usr/bin/git /somewhere/to/backup/just/in/case
  sudo rm /Applications/Xcode.app/Contents/Developer/usr/bin/git
  sudo ln -s /usr/local/bin/git /Applications/Xcode.app/Contents/Developer/usr/bin/git

[ Parent | on HN ]

Re:Remote code execution, git, and OS X by pyre on Monday April 18, 2016 @07:50AM (#11519145)

Is the git binary where the vulnerability is... or is it in one of these:

  $ ls $(git --exec-path)

[ Parent | on HN ]

Re:Remote code execution, git, and OS X by yelnatz on Monday April 18, 2016 @02:48AM (#11518120)

    chmod: /Applications/Xcode.app/Contents/Developer/usr/bin/git: No such file or directory

I don't have Xcode installed, do I have to install it back to do this?

[ Parent | on HN ]

Re:Remote code execution, git, and OS X by joelkesler on Monday April 18, 2016 @03:44AM (#11518316)

If you do not have Xcode installed but do have the Command Line Tools, you will find the vulnerable git /Library/Developer/CommandLineTools/usr/bin/git

so the command would be:

  sudo chmod -x /Library/Developer/CommandLineTools/usr/bin/git

[ Parent | on HN ]

Re:Remote code execution, git, and OS X by madeofpalk on Monday April 18, 2016 @02:54AM (#11518142)

If you don't have Xcode installed then you don't have git.

IIRC, you might have a /usr/bin/git executable but that's not actually git, all it does is shows a GUI that prompts you to install XCode

[ Parent | on HN ]

Re:Remote code execution, git, and OS X by yelnatz on Monday April 18, 2016 @03:04AM (#11518173)

Thanks.

Yea, /usr/bin/git is still there:

    $ git --version
    $ git version 2.6.4 (Apple Git-63)

But glad to know it won't do anything.

[ Parent | on HN ]

Re:Remote code execution, git, and OS X by danieldk on Monday April 18, 2016 @04:32AM (#11518461)

Try:

    % xcrun --find git

[ Parent | on HN ]

Re:Remote code execution, git, and OS X by capitalsigma on Monday April 18, 2016 @04:40AM (#11518491)

> IIRC, you might have a /usr/bin/git executable but that's not actually git, all it does is shows a GUI that prompts you to install XCode

wat

[ Parent | on HN ]

Re:Remote code execution, git, and OS X by dchest on Monday April 18, 2016 @02:51AM (#11518134)

No, vulnerable git ships with Xcode.

[ Parent | on HN ]