Tortoise SVN 1.6.10 build 19898 the Windows DLL hijacking vulnerability.

2010.09.01

Credit: Nikhil Mittal

Risk: Medium

Local: Yes

Remote: No

CVE: CVE-2010-3199

CWE: CWE-Other

Ogólna skala CVSS: 9.3/10

Znaczenie: 10/10

Łatwość wykorzystania: 8.6/10

Wymagany dostęp: Zdalny

Złożoność ataku: Średnia

Autoryzacja: Nie wymagana

Wpływ na poufność: Pełny

Wpływ na integralność: Pełny

Wpływ na dostępność: Pełny

1. Overview
Tortoise SVN is vulnerable to Windows DLL Hijacking Vulnerability. Version 1.6.10, Build 19898 (latest available on 30th August 2010 was tested) is vulnerable.

2. Vulnerability Description
Tortoise SVN passes insufficiently qualified path for the dll "dwmapi.dll" while opening a file using TortoiseProc

Timeline
30-08-2010 - Discovered Vulnerability
30-08-2010 - Informed the developers
30-08-2010 - Response from developers (in 25  minutes)
31-08-2010 - Disclosure

3. Exploitability
A file extension needs to be registered with TortoiseProc to exploit the vulnerability and a crafted file needs to be opened from a network share.

4. Versions Affected
TortoiseSVN 1.6.10, Build 19898 and lower.

5. POC/Exploit
Done with Webdav hijack module of Metasploit

6. Impact
Remote Code Execution in context of TortoiseProc

7. References
http://tortoisesvn.tigris.org/ds/viewMessage.do?dsForumId=4061&dsMessageId=2653163

8. Solution
Fix awaited from Microsoft. Meanwhile workarounds can be found here http://www.microsoft.com/technet/security/advisory/2269637.mspx

---------------------------------------
Nikhil Mittal

Referencje:

http://www.securityfocus.com/archive/1/archive/1/513463/100/0/threaded

http://www.securityfocus.com/archive/1/archive/1/513442/100/0/threaded

http://tortoisesvn.tigris.org/ds/viewMessage.do?dsForumId=4061&dsMessageId=2653202&orderBy=createDate&orderType=desc

http://tortoisesvn.tigris.org/ds/viewMessage.do?dsForumId=4061&dsMessageId=2653163

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Tortoise SVN 1.6.10 build 19898 the Windows DLL hijacking vulnerability.

Referencje:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.