Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

So then give find a proper predicate:

$ find /usr -name git -type f -xdev -exec {} -v \;



No... tadfisher's point was that even if a fixed version of git is installed, some other program -- say, a wrapper script for git -- might still invoke OS X's vulnerable version if it directly references "/usr/bin/git". So, such a system could become compromised if that wrapper script was used to access an untrustworthy repo.

All your invocation of find does is enumerate every file (or directory) under /usr named "git" and execute it with the -v option. In addition to dumping a lot of error messages, all that would do is eventually run "/usr/bin/git -v" and inform you that yep, your system still has the vulnerable version of git installed.

In other words, tadfisher's point, which I now wish had been made explicitly, is that simply installing the fixed version of git is possibly insufficient to secure your system. You also ought to either disable /usr/bin/git or convince yourself that no program will invoke it. Disabling /usr/bin/git is probably easier.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: