bugtraq - Tortoise SVN DLL Hijacking Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201008311541.o7VFfJnH006023@www3.securityfocus.com>
Date: Tue, 31 Aug 2010 09:41:19 -0600
From: nikhil_uitrgpv@...oo.co.in
To: bugtraq@...urityfocus.com
Subject: Tortoise SVN DLL Hijacking Vulnerability

1. Overview
Tortoise SVN is vulnerable to Windows DLL Hijacking Vulnerability. Version 1.6.10, Build 19898 (latest available on 30th August 2010 was tested) is vulnerable.

2. Vulnerability Description
Tortoise SVN passes insufficiently qualified path for the dll "dwmapi.dll" while opening a file using TortoiseProc

Timeline
30-08-2010 - Discovered Vulnerability
30-08-2010 - Informed the developers
30-08-2010 - Response from developers (in 25  minutes)
31-08-2010 - Disclosure

3. Exploitability
A file extension needs to be registered with TortoiseProc to exploit the vulnerability and a crafted file needs to be opened from a network share.

4. Versions Affected
TortoiseSVN 1.6.10, Build 19898 and lower.

5. POC/Exploit
Done with Webdav hijack module of Metasploit

6. Impact
Remote Code Execution in context of TortoiseProc

7. References
http://tortoisesvn.tigris.org/ds/viewMessage.do?dsForumId=4061&dsMessageId=2653163

8. Solution
Fix awaited from Microsoft. Meanwhile workarounds can be found here http://www.microsoft.com/technet/security/advisory/2269637.mspx

---------------------------------------
Nikhil Mittal