当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-057225

漏洞标题：腾讯某SVN服务器启用了OPENSSL TLS 可导致SVN账号密码泄露

相关厂商：腾讯

漏洞作者： 猪猪侠

提交时间：2014-04-15 23:25

修复时间：2014-04-16 09:21

公开时间：2014-04-16 09:21

漏洞类型：敏感信息泄露

危害等级：高

自评Rank：20

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-04-15： 细节已通知厂商并且等待厂商处理中
2014-04-16： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

互联网上大量Subversion服务器采用WebDav+OpenSSL进行认证
腾讯某SVN服务器启用了OPENSSL TLS,可导致SVN账号密码泄露
SVN账号密码泄露，将代表源码间接被读取，被二次放大利用，危害将非常严重。

详细说明：

#1 服务器信息
服务器IP：183.60.118.90
https://183.60.118.90

漏洞证明：

#2 泄露信息

.@....SC[...r....+..H...9........w.3....f.....".!.9.8.........5.............................3.2.....E.D...../...A.................................I...........4.2...................................................#....... text/xml..Accept-Encoding: gzip..DAV: http://subversion.tigris.org/xmlns/dav/svn/depth..DAV: http://subversion.tigris.org/xmlns/dav/svn/mergeinfo..DAV: http://subversion.tigris.org/xmlns/dav/svn/log-revprops..Content-Length: 104..Accept-Encoding: gzip..Authorization: Basic YnVpbGRlcjpidWlsZGVy........1?/|n.3o.V............C..Zv..ga.z!......................w.5........0..0...U......k......,..e.5...}.".0....U.#...0....k......,..e.5...}.".......0..1.0...U....CN1.0...U....SH1.0...U....SH1.0...U....Tencent1.0...U....APP1.0...U....svn.vendor.com1'0%..*.H........phillipzhang@tencent.com....JbQ'...0...U....0....0...*.H................1.|.....*.}@.....{.m...d./.....%6S.....U.d..r..,8%.l...J.RE.P.....*#"..bM-.m`.:h..ogc.....Y.....qW..-".8j..66$.`&......z.l{.............}.@....6...J......9._R...t....Q....c.r......~..Z.y.B.*).2JFzc^..Y.7{...3..F..;r....x.[....xt.}.......3...b....t}.....h..9>.$!.......\8......E..........QEw,I...F,hz.....C&..,F...RfC.f.h....JwU.\.....$.....iq.....8x.....P|.. [.%.*....xA.*....Z..........#..X5........A.U.....+cY...c.u|C.\.......@F.g.......z..U......~..W.<..*...K.Y.+xp.2...1.u..FQ......G...x.V.x`a..MY.@.4.{...J.. ...M..h<vl.zQ...........r.Yj.m../...?Q.e...7......~q..mW*..+Y.a/.9W...0.&nO...2.... .g!A..:.T=.'.<...o.^...s/.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................Q...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

修复方案：

补丁

版权声明：转载请注明来源 猪猪侠@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2014-04-16 09:21

厂商回复：

非常感谢您的反馈。该问题已经通过其它渠道发现，并于9号修复完毕。如您有进一步发现，请及时与我们联系，我们会有专人跟进处理。

漏洞Rank：8 (WooYun评价)

最新状态：

暂无

漏洞评价：

评论

  1. 2014-04-15 23:28 | hacker@sina.cn ( 普通白帽子 | Rank:288 漏洞数:27 | ANONYMOUS)

    点个赞

  2. 2014-04-15 23:30 | Focusstart ( 普通白帽子 | Rank:574 漏洞数:163 | 努力让某某某成为最幸福的女人！)

    一楼供应猪猪侠私藏玉照～

  3. 2014-04-15 23:38 | zeracker 认证白帽子 ( 核心白帽子 | Rank:1068 漏洞数:137 | 多乌云、多机会!微信公众号: id:a301zls ...)

    。。。

  4. 2014-04-16 00:15 | 淡漠天空 认证白帽子 ( 实习白帽子 | Rank:1113 漏洞数:142 | M:出售GOV STATE NSA CIA NASA DHS Symant...)

    四楼供应猪猪侠东莞街拍照

  5. 2014-04-16 00:21 | blackexp ( 实习白帽子 | Rank:36 漏洞数:13 | 一点一点的渗透到...)

    太牛逼，膜拜ing

  6. 2014-04-16 00:45 | 老笨蛋 ( 路人 | Rank:29 漏洞数:8 | 老笨蛋一个)

    六楼供应猪猪侠东莞街拍照

  7. 2014-04-16 09:27 | 计算姬 ( 普通白帽子 | Rank:398 漏洞数:90 | 看我看我看我啊)

    9号修复完毕怎么还测出来了？猪猪侠的工具不给力？

  8. 2014-04-16 09:37 | T-MAC ( 路人 | Rank:19 漏洞数:2 )

    9号就修复了那他怎么15号还能测出来？还是他前期测得藏到15号才发出来？还是。。。？

  9. 2014-04-16 11:03 | wefgod ( 普通白帽子 | Rank:1807 漏洞数:179 | 力不从心)

    不明真相

  10. 2014-04-16 11:26 | 猪猪侠 认证白帽子 ( 核心白帽子 | Rank:3224 漏洞数:254 | 你都有那么多超级棒棒糖了，还要自由干吗？)

    @T-MAC Subversion安装时必装openssl，貌似SVN的认证那里就使用了TLS，只是提醒这个漏洞还可以辐射到SVN这个被遗忘的服务！！！

  11. 2014-04-16 15:32 | Fate ( 实习白帽子 | Rank:51 漏洞数:5 | www.0hk.org)

    @猪猪侠 太牛逼啦！我咋没想到！

  12. 2014-04-20 22:44 | 炯炯虾 ( 路人 | Rank:2 漏洞数:1 | 我来自地球)

    就是扫https看到里面有svn 就联想到svn也有漏洞咯