ID CVE-2016-3105
Summary The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.
References
Vulnerable Configurations
  • Debian Linux 8.0 (Jessie)
    cpe:2.3:o:debian:debian_linux:8.0
  • Mercurial Mercurial 3.7.3
    cpe:2.3:a:mercurial:mercurial:3.7.3
CVSS
Base: 6.8 (as of 10-05-2016 - 09:46)
Impact:
Exploitability:
CWE CWE-284
CAPEC
  • Embedding Scripts within Scripts
    An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute scripts. The attacker leverages this capability to execute scripts to execute his/her own script by embedding it within other scripts that the target software is likely to execute. The attacker must have the ability to inject script into script that is likely to be executed. If this is done, then the attacker can potentially launch a variety of probes and attacks against the web server's local environment, in many cases the so-called DMZ, back end resources the web server can communicate with, and other hosts. With the proliferation of intermediaries, such as Web App Firewalls, network devices, and even printers having JVMs and Web servers, there are many locales where an attacker can inject malicious scripts. Since this attack pattern defines scripts within scripts, there are likely privileges to execute said attack on the host. Of course, these attacks are not solely limited to the server side, client side scripts like Ajax and client side JavaScript can contain malicious scripts as well. In general all that is required is for there to be sufficient privileges to execute a script, but not protected against writing.
  • Signature Spoofing by Key Theft
    An attacker obtains an authoritative or reputable signer's private signature key by theft and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
nessus via4
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_78ABC0220FEE11E69A1C0014A5A57822.NASL
    description Mercurial reports : CVE-2016-3105: Arbitrary code execution when converting Git repos
    last seen 2018-11-13
    modified 2018-11-10
    plugin id 90845
    published 2016-05-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=90845
    title FreeBSD : mercurial -- arbitrary code execution vulnerability (78abc022-0fee-11e6-9a1c-0014a5a57822)
  • NASL family Slackware Local Security Checks
    NASL id SLACKWARE_SSA_2016-123-01.NASL
    description New mercurial packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix a security issue.
    last seen 2019-02-21
    modified 2016-12-01
    plugin id 90836
    published 2016-05-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=90836
    title Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : mercurial (SSA:2016-123-01)
  • NASL family PhotonOS Local Security Checks
    NASL id PHOTONOS_PHSA-2016-0011.NASL
    description An update of [apache-tomcat,mercurial] packages for PhotonOS has been released.
    last seen 2019-02-21
    modified 2019-02-07
    plugin id 111845
    published 2018-08-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=111845
    title Photon OS 1.0: Apache / Mercurial PHSA-2016-0011 (deprecated)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2016-609.NASL
    description This update for mercurial fixes the following issues : Security issue fixed : - CVE-2016-3105: Fixed arbitrary code execution whenusing the convert extension on Git repo. (boo#978391)
    last seen 2019-02-21
    modified 2016-10-13
    plugin id 91279
    published 2016-05-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=91279
    title openSUSE Security Update : mercurial (openSUSE-2016-609)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-3570.NASL
    description Blake Burkhart discovered an arbitrary code execution flaw in Mercurial, a distributed version control system, when using the convert extension on Git repositories with specially crafted names. This flaw in particular affects automated code conversion services that allow arbitrary repository names.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 90929
    published 2016-05-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=90929
    title Debian DSA-3570-1 : mercurial - security update
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DLA-459.NASL
    description Blake Burkhart discovered an arbitrary code execution flaw in Mercurial, a distributed version control system, when using the convert extension on Git repositories with specially crafted names. This flaw in particular affects automated code conversion services that allow arbitrary repository names. Patches are taken from the Jessie version. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-07-09
    plugin id 90943
    published 2016-05-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=90943
    title Debian DLA-459-1 : mercurial security update
  • NASL family PhotonOS Local Security Checks
    NASL id PHOTONOS_PHSA-2016-0011_MERCURIAL.NASL
    description An update of the mercurial package has been released.
    last seen 2019-02-08
    modified 2019-02-07
    plugin id 121646
    published 2019-02-07
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=121646
    title Photon OS 1.0: Mercurial PHSA-2016-0011
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201612-19.NASL
    description The remote host is affected by the vulnerability described in GLSA-201612-19 (Mercurial: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Mercurial. Please review the CVE identifier and bug reports referenced for details. Impact : A remote attacker could possibly execute arbitrary code with the privileges of the process. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2016-12-07
    plugin id 95605
    published 2016-12-07
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=95605
    title GLSA-201612-19 : Mercurial: Multiple vulnerabilities
refmap via4
bid 90536
confirm
debian DSA-3570
gentoo GLSA-201612-19
slackware SSA:2016-123-01
suse openSUSE-SU-2016:1336
Last major update 30-11-2016 - 22:09
Published 09-05-2016 - 16:59
Last modified 30-06-2017 - 21:29
Back to Top