lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
From: greuff at (Thomas Wana)
Subject: - neon format string bugs

[VSA0401 - neon - security notice]


We have discovered a format string vulnerability in neon
( neon is a webdav client
library, used by Subversion and others.

CVE has assigned the name CAN-2004-0179 to this issue.

Affected Versions

This affects neon versions 0.19.0 onwards when ne_set_error
was changed from taking a single char* to taking printf-style


Middle. Man-in-the-middle-attack or fake server needed. Note
that all clients using this library (such as Subversion) are


neon 0.24.5 fixes the described problem. You can get it from


grep for ne_set_error and see for yourself.
One particular bug is that if the response of the webserver
doesn't start with "HTTP", it is considered invalid and will
be logged via ne_set_error. You can supply %08x%08x etc there
and it will be executed by a libc format function.

webdav-requests always start with PROPFIND:


PROPFIND /lenya/blog/authoring/entries/2003/08/24/peanuts/ HTTP/1.1
Pragma: no-cache
Cache-control: no-cache
Accept: text/*, image/jpeg, image/png, image/*, */*
Accept-Encoding: x-gzip, gzip, identity
Accept-Charset: iso-8859-1, utf-8;q=0.5, *;q=0.5
Accept-Language: en
Depth: 0


HTTP/1.1 207 Multi-Status
X-Cocoon-Version: 2.1
Set-Cookie: JSESSIONID=320E3B1395B867B5BC42B5FC93457C36; Path=/lenya
Content-Type: text/xml
Transfer-Encoding: chunked
Date: Mon, 25 Aug 2003 14:27:12 GMT
Server: Apache Coyote/1.0

<?xml version="1.0" encoding="UTF-8"?>
<D:multistatus xmlns:D="DAV:">

<D:response xmlns:lp1="DAV:" xmlns:lp2="">
<D:status>HTTP/1.1 200 OK</D:status>


The formatstring bug can be triggered with a response like:


2004-03-10: Bug discovered
2004-03-15: Contacted (maintainer)
2004-03-16: Maintainer confirmation
2004-04-14: Maintainer released fixed version 0.24.5
2004-04-16: Public disclosure

Discovered by

Thomas Wana <>

Joe Orton (neon maintainer)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: signature
Url :

Powered by blists - more mailing lists