Menu
Apple patches vulnerable OS X Git version that put developers at risk

Apple patches vulnerable OS X Git version that put developers at risk

A month and a half later, Apple imports Git patches for critical remote code execution flaws

Apple has released a new version of its Xcode development tool in order to patch two critical vulnerabilities in the Git source code management client.

The Git vulnerabilities, CVE‑2016‑2324 and CVE‑2016‑2315, have been known since mid-March and can be exploited when cloning a repository with a specially crafted file structure. This allows attackers to execute malicious code on systems where such cloning operations were initiated.

Xcode is an integrated development environment (IDE) used by a large number of developers to write applications for OS X and iOS. It includes a package called the OS X Command Line Tools for Xcode that contains the open-source Git client.

The version of Git shipped with the command line tools package has now been updated to 2.7.4. This version was released by the Git developers on March 17, but it took Apple a month and a half to integrate into Xcode.

Some systems administrators criticized Apple last month for dragging its feet on importing the upstream patches for such serious flaws. In the absence of a fix, they had to resort to hackery in order to disable Git on Macs in their organizations, potentially breaking workflows.

The Command Line Tools package is not installed by default on OS X, but users can install it separately from Xcode itself. Systems who have it installed should receive an update notification through the Mac App Store.


Follow Us

Join the newsletter!

Error: Please check your email address.

Featured

Slideshows

Sizing up the NZ security spectrum - Where's the channel sweet spot?

Sizing up the NZ security spectrum - Where's the channel sweet spot?

From new extortion schemes, outside threats and rising cyber attacks, the art of securing the enterprise has seldom been so complex or challenging. With distance no longer a viable defence, Kiwi businesses are fighting to stay ahead of the security curve. In total, 28 per cent of local businesses faced a cyber attack last year, with the number in New Zealand set to rise in 2017. Yet amidst the sensationalism, media headlines and ongoing high profile breaches, confusion floods the channel, as partners seek strategic methods to combat rising sophistication from attackers. In sizing up the security spectrum, this Reseller News roundtable - in association with F5 Networks, Kaspersky Lab, Tech Data, Sophos and SonicWall - assessed where the channel sweet spot is within the New Zealand channel. Photos by Maria Stefina.

Sizing up the NZ security spectrum - Where's the channel sweet spot?
Show Comments