libgit2 Vulnerabilities Expose Older Ubuntu LTS Versions to Remote Attacks
Multiple flaws in libgit2 affect Ubuntu 14.04, 16.04, and 18.04 LTS, potentially allowing denial of service or arbitrary code execution.
TL;DR
- Several libgit2 protocol handling flaws impact older Ubuntu LTS systems.
- Remote attackers may trigger denial of service or execute arbitrary code.
- Local attackers could also exploit index file handling issues.
- Affected versions include Ubuntu 14.04, 16.04, and 18.04 LTS.
- Organizations should review and patch systems immediately.
Security researchers have identified multiple vulnerabilities in libgit2, a core library used for Git operations, affecting several Ubuntu Long Term Support (LTS) versions. These flaws primarily stem from improper handling of Git Smart Protocol elements and HTTP transport mechanisms.
The most severe issues allow remote attackers to crash services or potentially run arbitrary code, while others enable server spoofing or denial of service through malformed packets. Organizations using Ubuntu 14.04, 16.04, or 18.04 LTS in development or production environments should assess their exposure immediately.
Protocol Handling Flaws Enable Remote Exploitation
- CVE-2016-10128 allows remote code execution due to incorrect Git Smart Protocol handling.
- CVE-2016-10129 causes denial of service via empty packet lines in the same protocol.
- CVE-2018-15501 affects additional Ubuntu versions through crafted 'ng' packets.
- All remote attack vectors specifically target outdated Ubuntu LTS systems.
Local Attack Surface and Mitigation Steps
- CVE-2016-10130 enables HTTP transport spoofing but is limited to Ubuntu 16.04 LTS.
- Index file handling issues discovered by Krishna Ram Prakash R and Vivek Parikh pose local DoS risks.
- Only Ubuntu 14.04 and 16.04 are affected by the repository index vulnerability.
- Administrators should upgrade or apply patches if still running these legacy systems.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.