Errors in handling case-sensitive directories allow for remote code execution on pull

FYI, mercurial is in universe and is therefore community maintained. I took a look at it and have prepared packages in https://launchpad.net/~ubuntu-security-proposed/+archive/ubuntu/ppa/+packages. If someone could test them and verify they are ok, I can push them out as a security update.

Note, the packages in the ppa have not been tested yet (14.04-15.04 do pass the testsuite though, 12.04 needs a manual test run), so take care.

Jamie, I see in the changelog that you have applied this patches:

    - http://selenic.com/repo/hg-stable/rev/035434b407be
    - http://selenic.com/repo/hg-stable/rev/885bd7c5c7e3
    - http://selenic.com/repo/hg-stable/rev/c02a05cc6f5e
    - http://selenic.com/repo/hg-stable/rev/7a5bcd471f2e
    - http://selenic.com/repo/hg-stable/rev/6dad422ecc5a

Have you checked with upstream if those are the only patches needed? Based on the release notes and the commit log I think you are right, but it may be worth double-checking with upstream.

Status changed to 'Confirmed' because the bug affects multiple users.

FYI, the 14.04 mercurial packages FTBFS due to an unrelated issue: https://launchpad.net/~ubuntu-security-proposed/+archive/ubuntu/ppa/+build/6661971/+files/buildlog_ubuntu-trusty-amd64.mercurial_2.8.2-1ubuntu1.1_FAILEDTOBUILD.txt.gz. Specifically, the hghave tests are failing (and the fail with a no change rebuild too). If someone wanted to help debug that issue, that would be great. Thanks!

Jamie, the problem you have is that the patch you've backported passes "repo" as the first parameter to context.memfilectx() but in the mercurial version that you have, context.memfilectx() only receives the path and text. Just drop the "repo" argument in the tests as I've done for Debian Wheezy[0] and they will run.

[0] http://anonscm.debian.org/viewvc/python-apps/packages/mercurial/branches/wheezy/debian/patches/

This is not the best explanation ever, I'll send a patch later today.

Find the patch for the failing test-commit.t attached.

The attachment "fix test-commit.t for mercurial_2.8.2-1ubuntu1.1" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

Thanks Javi! I've applied these and are testing them locally. I'll upload to the ppa once finished.

mercurial on 15.04 was fixed in 3.1.2-2.

Javi, alright, so I updated that test with your patch as mentioned (thanks) which I certainly would've needed to do anyway, but test-hghave.t.sh on 14.04 never finishes and FTBFS (and it does with unpatched mercurial too). I'm happy to look at this myself when I have more time, but do you have an idea why this is won't finish on 14.04, but does on other releases and Debian? Thanks

This bug was fixed in the package git - 1:2.1.0-1ubuntu0.1

---------------
git (1:2.1.0-1ubuntu0.1) utopic-security; urgency=medium

  * SECURITY UPDATE: Add protections against malicious git commits that
    overwrite git metadata on HFS+ and NTFS filesystems. Some of the
    protections are enabled by default but the majority require git config
    options to be enabled. Set the core.protectHFS and/or core.protectNTFS git
    config variables to "true" if you use HFS+ and/or NTFS filesystems when
    pulling from untrusted git trees. Set the core.protectHFS,
    core.protectNTFS, and receive.fsckObjects git config variables to "true"
    if you host git trees and want to prevent malicious git commits from being
    pushed to your server. (LP: #1404035)
    - debian/diff/0009-CVE-2014-9390.diff: Check for potentially malicious
      paths in git commits. Based on upstream patches.
    - debian/rules: Set executable bit on a new test introduced in
      0009-CVE-2014-9390.diff
    - CVE-2014-9390
 -- Tyler Hicks <email address hidden> Tue, 13 Jan 2015 12:42:16 -0600

This bug was fixed in the package git - 1:1.7.9.5-1ubuntu0.1

---------------
git (1:1.7.9.5-1ubuntu0.1) precise-security; urgency=medium

  * SECURITY UPDATE: Add protections against malicious git commits that
    overwrite git metadata on HFS+ and NTFS filesystems. Some of the
    protections are enabled by default but the majority require git config
    options to be enabled. Set the core.protectHFS and/or core.protectNTFS git
    config variables to "true" if you use HFS+ and/or NTFS filesystems when
    pulling from untrusted git trees. Set the core.protectHFS,
    core.protectNTFS, and receive.fsckObjects git config variables to "true"
    if you host git trees and want to prevent malicious git commits from being
    pushed to your server. (LP: #1404035)
    - debian/diff/0015-CVE-2014-9390.diff: Check for potentially malicious
      paths in git commits. Based on upstream patches.
    - debian/rules: Set executable bit on a new test introduced in
      0015-CVE-2014-9390.diff
    - CVE-2014-9390
 -- Tyler Hicks <email address hidden> Tue, 13 Jan 2015 12:42:19 -0600

This bug was fixed in the package git - 1:1.9.1-1ubuntu0.1

---------------
git (1:1.9.1-1ubuntu0.1) trusty-security; urgency=medium

  * SECURITY UPDATE: Add protections against malicious git commits that
    overwrite git metadata on HFS+ and NTFS filesystems. Some of the
    protections are enabled by default but the majority require git config
    options to be enabled. Set the core.protectHFS and/or core.protectNTFS git
    config variables to "true" if you use HFS+ and/or NTFS filesystems when
    pulling from untrusted git trees. Set the core.protectHFS,
    core.protectNTFS, and receive.fsckObjects git config variables to "true"
    if you host git trees and want to prevent malicious git commits from being
    pushed to your server. (LP: #1404035)
    - debian/diff/0010-CVE-2014-9390.diff: Check for potentially malicious
      paths in git commits. Based on upstream patches.
    - debian/rules: Set executable bit on a new test introduced in
      0010-CVE-2014-9390.diff
    - CVE-2014-9390
 -- Tyler Hicks <email address hidden> Tue, 13 Jan 2015 12:42:17 -0600

Vivid's git was previously updated for CVE-2014-9390 by an auto sync of git 1:2.1.4-2 from Debian Sid.

This bug was fixed in the package mercurial - 2.0.2-1ubuntu1.2

---------------
mercurial (2.0.2-1ubuntu1.2) precise-security; urgency=medium

  [ Jamie Strandboge ]
  * SECURITY UPDATE: fix for improperly handling case-insensitive paths on
    Windows and OS X clients
    - http://selenic.com/repo/hg-stable/rev/885bd7c5c7e3
    - http://selenic.com/repo/hg-stable/rev/c02a05cc6f5e
    - http://selenic.com/repo/hg-stable/rev/6dad422ecc5a
    - CVE-2014-9390
    - LP: #1404035

  [ Marc Deslauriers ]
  * SECURITY UPDATE: arbitrary command exection via crafted repository
    name in a clone command
    - d/p/from_upstream__sshpeer_more_thorough_shell_quoting.patch: add
      more thorough shell quoting to mercurial/sshrepo.py.
    - CVE-2014-9462

 -- Marc Deslauriers <email address hidden> Wed, 17 Jun 2015 13:27:17 -0400

This bug was fixed in the package mercurial - 3.1.1-1ubuntu0.2

---------------
mercurial (3.1.1-1ubuntu0.2) utopic-security; urgency=medium

  [ Jamie Strandboge ]
  * SECURITY UPDATE: fix for improperly handling case-insensitive paths on
    Windows and OS X clients
    - http://selenic.com/repo/hg-stable/rev/885bd7c5c7e3
    - http://selenic.com/repo/hg-stable/rev/c02a05cc6f5e
    - http://selenic.com/repo/hg-stable/rev/6dad422ecc5a
    - CVE-2014-9390
    - LP: #1404035

  [ Marc Deslauriers ]
  * SECURITY UPDATE: arbitrary command exection via crafted repository
    name in a clone command
    - d/p/from_upstream__sshpeer_more_thorough_shell_quoting.patch: add
      more thorough shell quoting to mercurial/sshpeer.py.
    - CVE-2014-9462

 -- Marc Deslauriers <email address hidden> Wed, 17 Jun 2015 13:09:05 -0400

This bug was fixed in the package mercurial - 2.8.2-1ubuntu1.3

---------------
mercurial (2.8.2-1ubuntu1.3) trusty-security; urgency=medium

  [ Jamie Strandboge ]
  * SECURITY UPDATE: fix for improperly handling case-insensitive paths on
    Windows and OS X clients
    - http://selenic.com/repo/hg-stable/rev/885bd7c5c7e3
    - http://selenic.com/repo/hg-stable/rev/c02a05cc6f5e
    - http://selenic.com/repo/hg-stable/rev/6dad422ecc5a
    - CVE-2014-9390
    - LP: #1404035

  [ Marc Deslauriers ]
  * SECURITY UPDATE: arbitrary command exection via crafted repository
    name in a clone command
    - d/p/from_upstream__sshpeer_more_thorough_shell_quoting.patch: add
      more thorough shell quoting to mercurial/sshpeer.py.
    - CVE-2014-9462
  * debian/patches/fix_ftbfs_patchbomb_test.patch: fix patchbomb test.

 -- Marc Deslauriers <email address hidden> Wed, 17 Jun 2015 10:51:42 -0400