Tortoise SVN 1.6.10 build 19898 the Windows DLL hijacking vulnerability.

2010.09.01
Credit: Nikhil Mittal
Risk: Medium
Local: Yes
Remote: No
CWE: CWE-Other


Ogólna skala CVSS: 9.3/10
Znaczenie: 10/10
Łatwość wykorzystania: 8.6/10
Wymagany dostęp: Zdalny
Złożoność ataku: Średnia
Autoryzacja: Nie wymagana
Wpływ na poufność: Pełny
Wpływ na integralność: Pełny
Wpływ na dostępność: Pełny

1. Overview Tortoise SVN is vulnerable to Windows DLL Hijacking Vulnerability. Version 1.6.10, Build 19898 (latest available on 30th August 2010 was tested) is vulnerable. 2. Vulnerability Description Tortoise SVN passes insufficiently qualified path for the dll "dwmapi.dll" while opening a file using TortoiseProc Timeline 30-08-2010 - Discovered Vulnerability 30-08-2010 - Informed the developers 30-08-2010 - Response from developers (in 25 minutes) 31-08-2010 - Disclosure 3. Exploitability A file extension needs to be registered with TortoiseProc to exploit the vulnerability and a crafted file needs to be opened from a network share. 4. Versions Affected TortoiseSVN 1.6.10, Build 19898 and lower. 5. POC/Exploit Done with Webdav hijack module of Metasploit 6. Impact Remote Code Execution in context of TortoiseProc 7. References http://tortoisesvn.tigris.org/ds/viewMessage.do?dsForumId=4061&dsMessageId=2653163 8. Solution Fix awaited from Microsoft. Meanwhile workarounds can be found here http://www.microsoft.com/technet/security/advisory/2269637.mspx --------------------------------------- Nikhil Mittal

Referencje:

http://www.securityfocus.com/archive/1/archive/1/513463/100/0/threaded
http://www.securityfocus.com/archive/1/archive/1/513442/100/0/threaded
http://tortoisesvn.tigris.org/ds/viewMessage.do?dsForumId=4061&dsMessageId=2653202&orderBy=createDate&orderType=desc
http://tortoisesvn.tigris.org/ds/viewMessage.do?dsForumId=4061&dsMessageId=2653163


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top