当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2014-057225

漏洞标题:腾讯某SVN服务器启用了OPENSSL TLS 可导致SVN账号密码泄露

相关厂商:腾讯

漏洞作者: 猪猪侠

提交时间:2014-04-15 23:25

修复时间:2014-04-16 09:21

公开时间:2014-04-16 09:21

漏洞类型:敏感信息泄露

危害等级:高

自评Rank:20

漏洞状态:漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2014-04-15: 细节已通知厂商并且等待厂商处理中
2014-04-16: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

互联网上大量Subversion服务器采用WebDav+OpenSSL进行认证
腾讯某SVN服务器启用了OPENSSL TLS,可导致SVN账号密码泄露
SVN账号密码泄露,将代表源码间接被读取,被二次放大利用,危害将非常严重。

详细说明:

#1 服务器信息
服务器IP:183.60.118.90
https://183.60.118.90

漏洞证明:

#2 泄露信息

[email protected][...r....+..H...9........w.3....f.....".!.9.8.........5.............................3.2.....E.D...../...A.................................I...........4.2...................................................#....... text/xml..Accept-Encoding: gzip..DAV: http://subversion.tigris.org/xmlns/dav/svn/depth..DAV: http://subversion.tigris.org/xmlns/dav/svn/mergeinfo..DAV: http://subversion.tigris.org/xmlns/dav/svn/log-revprops..Content-Length: 104..Accept-Encoding: gzip..Authorization: Basic YnVpbGRlcjpidWlsZGVy........1?/|n.3o.V............C..Zv..ga.z!......................w.5........0..0...U......k......,..e.5...}.".0....U.#...0....k......,..e.5...}.".......0..1.0...U....CN1.0...U....SH1.0...U....SH1.0...U....Tencent1.0...U....APP1.0...U....svn.vendor.com1'0%..*[email protected]'...0...U....0....0...*.H................1.|.....*.}@.....{.m...d./.....%6S.....U.d..r..,8%.l...J.RE.P.....*#"..bM-.m`.:h..ogc.....Y.....qW..-".8j..66$.`&......z.l{.............}[email protected]._R...t....Q....c.r......~..Z.y.B.*).2JFzc^..Y.7{...3..F..;r....x.[....xt.}.......3...b....t}.....h..9>.$!.......\8......E..........QEw,I...F,hz.....C&..,F...RfC.f.h....JwU.\.....$.....iq.....8x.....P|.. [.%.*....xA.*....Z..........#..X5........A.U.....+cY...c.u|C.\[email protected]......~..W.<..*...K.Y.+xp.2...1.u..FQ......G...x.V.x`[email protected].{...J.. ...M..h<vl.zQ...........r.Yj.m../...?Q.e...7......~q..mW*..+Y.a/.9W...0.&nO...2.... .g!A..:.T=.'.<...o.^...s/.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................Q...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

修复方案:

补丁

版权声明:转载请注明来源 猪猪侠@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2014-04-16 09:21

厂商回复:

非常感谢您的反馈。该问题已经通过其它渠道发现,并于9号修复完毕。如您有进一步发现,请及时与我们联系,我们会有专人跟进处理。

漏洞Rank:8 (WooYun评价)

最新状态:

暂无