lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <604870.85146.qm@web137416.mail.in.yahoo.com>
Date: Wed, 1 Sep 2010 08:22:50 +0530 (IST)
From: Nikhil Mittal <nikhil_uitrgpv@...oo.co.in>
To: full-disclosure@...ts.grok.org.uk
Subject: Tortoise SVN DLL Hijacking Vulnerability

1. Overview
Tortoise SVN is vulnerable to Windows DLL Hijacking Vulnerability. Version 1.6.10, Build 19898 (latest available on 30th August 2010 was tested) is vulnerable.

2. Vulnerability Description
Tortoise SVN passes insufficiently qualified path for the dll "dwmapi.dll" while opening a file using TortoiseProc

Timeline
30-08-2010 - Discovered Vulnerability
30-08-2010 - Informed the developers
30-08-2010 - Response from developers (in 25  minutes)
31-08-2010 - Disclosure


The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2010-3199 to this issue. This is a candidate for  inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems.


3. Exploitability
A file extension needs to be registered with TortoiseProc to exploit the vulnerability and a crafted file needs to be opened from a network share.

4. Versions Affected
TortoiseSVN 1.6.10, Build 19898 and lower.

5. POC/Exploit
Done with Webdav hijack module of Metasploit

6. Impact
Remote Code Execution in context of TortoiseProc

7. References
http://tortoisesvn.tigris.org/ds/viewMessage.do?dsForumId=4061&dsMessageId=2653163

8. Solution
Fix awaited from Microsoft. Meanwhile workarounds can be found here http://www.microsoft.com/technet/security/advisory/2269637.mspx

---------------------------------------
Nikhil Mittal






Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ