You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@subversion.apache.org by Parrish Knight <pa...@noaa.gov> on 2012/10/22 14:43:16 UTC
Subversion upgrade problem
Good morning:
I am the Help Desk Lead at the National Geodetic Survey, an agency of
NOAA, the National Oceanic and Atmospheric Administration. Currently,
I am in the process of migrating one of our developers from a rather
aged desktop to a more modern laptop. Part of our upgrade procedue is
for our security officer to scan all new seats for vulnerabilities
before approving them for release to the end user. I've got a bit of
a puzzler regarding a vulnerability in Subversion, and I have not been
able to locate a remedy. The recommended remedy is to uninstall all
previous versions of Subversion and install the most recent version
(currently 1.7.7). I followed this procedure, but our security
officer reported that the problem persists. I then uninstalled that
version, downloaded a different installer, and tried again, but still
no luck. I have not been able to find any alternative solution to the
problem. The OS on both the old system and the new one is Windows 7
Enterprise.
Any assistance that anyone might be able to give would be much
appreciated. I am not subscribed to the list, so please CC me on any
replies. Thank you in advance for any assistance you may be able to
give.
--
Parrish S. Knight
NGS Help Desk Lead
301-713-3254 x184
parrish.knight@noaa.gov
Re: Subversion upgrade problem
Posted by Thorsten Schöning <ts...@am-soft.de>.
Guten Tag Parrish Knight,
am Montag, 22. Oktober 2012 um 14:43 schrieben Sie:
> Any assistance that anyone might be able to give would be much
> appreciated.
Could you please mention the exact problem you have or did I just
oversee it? What vulnerability or problem are you talking about?
Mit freundlichen Grüßen,
Thorsten Schöning
--
Thorsten Schöning E-Mail:Thorsten.Schoening@AM-SoFT.de
AM-SoFT IT-Systeme http://www.AM-SoFT.de/
Telefon...........05151- 9468- 55
Fax...............05151- 9468- 88
Mobil..............0178-8 9468- 04
AM-SoFT GmbH IT-Systeme, Brandenburger Str. 7c, 31789 Hameln
AG Hannover HRB 207 694 - Geschäftsführer: Andreas Muchow
Re: Subversion upgrade problem
Posted by Parrish Knight <pa...@noaa.gov>.
On Mon, Oct 22, 2012 at 10:13 AM, Stefan Sperling <st...@elego.de> wrote:
> You could check if you can still see a libsvn_delta-1.dll (or similarly
> named file) left over from the old installation.
The only "libsvn" files I find on search are in the Subversion 1.7.7
directory, so that doesn't appear to be the problem. I'm pretty sure
I already rebooted last week as part of this process, but just in case
my memory is playing tricks on me, I rebooted again this morning and
will do another search in a little while.
>> Are you thinking it might be a false positive?
>
> Yes, that's possible and probably the first thing to check next.
Our security officer uses the Nessus scanner from Tenable -- www.tenable.com .
> Just to make sure I got this right: You're not scanning a Subversion
> server machine, but a Subversion client machine (a laptop), correct?
Correct.
> To detect the exploit in question it would have to try to remotely crash
> the Subversion client or server using an exploit tailored towards this
> specific vulnerability, crafting a custom svndiff data stream which
> triggers a crash, and then somehow detect remotely whether the client
> or server crashed because of this exploit.
>
> I doubt a general-purpose scanning tool would have such sophisticated
> exploit-specific checks built-in. So in this case I'd start out assuming
> a false positive unless the opposite is proven.
OK, I'm cc'ing our security officer on this thread to bring him into
the discussion and let him know where we're going.
--
Parrish S. Knight
NGS Help Desk Lead
301-713-3254 x184
parrish.knight@noaa.gov
Re: Subversion upgrade problem
Posted by Stefan Sperling <st...@elego.de>.
On Mon, Oct 22, 2012 at 09:55:33AM -0400, Parrish Knight wrote:
> > Are you sure the Subversion upgrade was done properly?
>
> I used Control Panel to uninstall the previous version, then I
> downloaded and unZIPped the most current version. Is there anythin I
> may have overlooked?
That sounds fine. Maybe windows also needs a reboot to pick up newly
installed Subversion libraries, but maybe it doesn't (I'm not a
Windows expert).
> > Maybe the server
> > is still using a vulnerable version of libsvn_delta by accident?
>
> How do I check for that? (I am unfamiliar with this software because
> I am not a developer. Please be patient with me... thanks.)
You could check if you can still see a libsvn_delta-1.dll (or similarly
named file) left over from the old installation.
> > How are you testing for this vulnerability?
>
> Our security officer runs a scan remotely to locate risks. I am
> uncertain which tool(s) he uses for this purpose. If you think it may
> be pertinent, I can ask him. Are you thinking it might be a false
> positive?
Yes, that's possible and probably the first thing to check next.
What is this scan actually doing and trying to detect?
Just to make sure I got this right: You're not scanning a Subversion
server machine, but a Subversion client machine (a laptop), correct?
To detect the exploit in question it would have to try to remotely crash
the Subversion client or server using an exploit tailored towards this
specific vulnerability, crafting a custom svndiff data stream which
triggers a crash, and then somehow detect remotely whether the client
or server crashed because of this exploit.
I doubt a general-purpose scanning tool would have such sophisticated
exploit-specific checks built-in. So in this case I'd start out assuming
a false positive unless the opposite is proven.
Re: Subversion upgrade problem
Posted by Parrish Knight <pa...@noaa.gov>.
On Mon, Oct 22, 2012 at 4:32 PM, Bob Archer <Bo...@amsi.com> wrote:
> Are you upgrading the client or the server?
The client.
We think we may have located the problem. The user also had Tortoise
installed, and it was an older version. We're trying to determine
whether upgrading will resolve.
--
Parrish S. Knight
NGS Help Desk Lead
301-713-3254 x184
parrish.knight@noaa.gov
RE: Subversion upgrade problem
Posted by Bob Archer <Bo...@amsi.com>.
> On Mon, Oct 22, 2012 at 9:47 AM, Stefan Sperling <st...@elego.de> wrote:
> > If he can reproduce this problem even with patches applied, please ask
> > him to report this as a new security issue with a reproduction recipe
> > included. Please see
> > http://subversion.apache.org/docs/community-guide/issues.html#security
> > for details on reporting security issues.
>
> I'll pass that information along to him as soon as we're reasonably certain that
> it's an actual issue. As you say, there are still a few other things to check,
> especially inasmuch as the help desk technicians here at NGS are not
> particularly familiar with open-source software.
>
> > Are you sure the Subversion upgrade was done properly?
>
> I used Control Panel to uninstall the previous version, then I downloaded and
> unZIPped the most current version. Is there anythin I may have overlooked?
Are you upgrading the client or the server?
BOb
Re: Subversion upgrade problem
Posted by Parrish Knight <pa...@noaa.gov>.
On Mon, Oct 22, 2012 at 9:47 AM, Stefan Sperling <st...@elego.de> wrote:
> If he can reproduce this problem even with patches applied, please
> ask him to report this as a new security issue with a reproduction
> recipe included. Please see
> http://subversion.apache.org/docs/community-guide/issues.html#security
> for details on reporting security issues.
I'll pass that information along to him as soon as we're reasonably
certain that it's an actual issue. As you say, there are still a few
other things to check, especially inasmuch as the help desk
technicians here at NGS are not particularly familiar with open-source
software.
> Are you sure the Subversion upgrade was done properly?
I used Control Panel to uninstall the previous version, then I
downloaded and unZIPped the most current version. Is there anythin I
may have overlooked?
> Maybe the server
> is still using a vulnerable version of libsvn_delta by accident?
How do I check for that? (I am unfamiliar with this software because
I am not a developer. Please be patient with me... thanks.)
> How are you testing for this vulnerability?
Our security officer runs a scan remotely to locate risks. I am
uncertain which tool(s) he uses for this purpose. If you think it may
be pertinent, I can ask him. Are you thinking it might be a false
positive?
> As far as I know an exploit
> was circulated privately among developers for testing purposes but was
> never made public. Did you write a new exploit or do you happen to have
> a repository data set that triggers the problem reliably?
The NGS is a pretty small agency. I am uncertain as to the exact
number of Subversion users here, but it's going to be very small --
it's even possible that my current customer is the only one.
> Please do not post reproduction recipes for security issues to this
> list -- it is publicly archived. Instead, feel free to continue this
> conversation via channels documented at
> http://subversion.apache.org/docs/community-guide/issues.html#security
> if you have some sort of sensitive data to share with us. Thanks.
Understood.
--
Parrish S. Knight
NGS Help Desk Lead
301-713-3254 x184
parrish.knight@noaa.gov
Re: Subversion upgrade problem
Posted by Stefan Sperling <st...@elego.de>.
On Mon, Oct 22, 2012 at 08:58:49AM -0400, Parrish Knight wrote:
> The reported problem is with earlier versions of Subversion, but our
> security officer reports that the problem persists even after an
> upgrade.
>
> "Multiple integer overflows in the libsvn_delta library in Subversion
> before 1.5.7, and 1.6.x before 1.6.4, allow remote authenticated users
> and remote Subversion servers to execute arbitrary code via an svndiff
> stream with large windows that trigger a heap-based buffer overflow, a
> related issue to CVE-2009-2412."
>
> http://www.orvant.com/vuln/detail/181334/CVE-2009-2411
If he can reproduce this problem even with patches applied, please
ask him to report this as a new security issue with a reproduction
recipe included. Please see
http://subversion.apache.org/docs/community-guide/issues.html#security
for details on reporting security issues.
That said, at the time I personally (as did several other developers)
reviewed and tested the fix for this issue, and could *not* trigger
the problem with the patches applied.
Are you sure the Subversion upgrade was done properly? Maybe the server
is still using a vulnerable version of libsvn_delta by accident?
How are you testing for this vulnerability? As far as I know an exploit
was circulated privately among developers for testing purposes but was
never made public. Did you write a new exploit or do you happen to have
a repository data set that triggers the problem reliably?
Please do not post reproduction recipes for security issues to this
list -- it is publicly archived. Instead, feel free to continue this
conversation via channels documented at
http://subversion.apache.org/docs/community-guide/issues.html#security
if you have some sort of sensitive data to share with us. Thanks.
Re: Subversion upgrade problem
Posted by Parrish Knight <pa...@noaa.gov>.
On Mon, Oct 22, 2012 at 8:54 AM, Stefan Sperling <st...@elego.de> wrote:
> On Mon, Oct 22, 2012 at 08:43:16AM -0400, Parrish Knight wrote:
>> Good morning:
>>
>> I am the Help Desk Lead at the National Geodetic Survey, an agency of
>> NOAA, the National Oceanic and Atmospheric Administration. Currently,
>> I am in the process of migrating one of our developers from a rather
>> aged desktop to a more modern laptop. Part of our upgrade procedue is
>> for our security officer to scan all new seats for vulnerabilities
>> before approving them for release to the end user. I've got a bit of
>> a puzzler regarding a vulnerability in Subversion, and I have not been
>> able to locate a remedy. The recommended remedy is to uninstall all
>> previous versions of Subversion and install the most recent version
>> (currently 1.7.7). I followed this procedure, but our security
>> officer reported that the problem persists.
>
> Hi,
>
> which problem do you mean exactly?
The reported problem is with earlier versions of Subversion, but our
security officer reports that the problem persists even after an
upgrade.
"Multiple integer overflows in the libsvn_delta library in Subversion
before 1.5.7, and 1.6.x before 1.6.4, allow remote authenticated users
and remote Subversion servers to execute arbitrary code via an svndiff
stream with large windows that trigger a heap-based buffer overflow, a
related issue to CVE-2009-2412."
http://www.orvant.com/vuln/detail/181334/CVE-2009-2411
--
Parrish S. Knight
NGS Help Desk Lead
301-713-3254 x184
parrish.knight@noaa.gov
Re: Subversion upgrade problem
Posted by Stefan Sperling <st...@elego.de>.
On Mon, Oct 22, 2012 at 08:43:16AM -0400, Parrish Knight wrote:
> Good morning:
>
> I am the Help Desk Lead at the National Geodetic Survey, an agency of
> NOAA, the National Oceanic and Atmospheric Administration. Currently,
> I am in the process of migrating one of our developers from a rather
> aged desktop to a more modern laptop. Part of our upgrade procedue is
> for our security officer to scan all new seats for vulnerabilities
> before approving them for release to the end user. I've got a bit of
> a puzzler regarding a vulnerability in Subversion, and I have not been
> able to locate a remedy. The recommended remedy is to uninstall all
> previous versions of Subversion and install the most recent version
> (currently 1.7.7). I followed this procedure, but our security
> officer reported that the problem persists.
Hi,
which problem do you mean exactly?
> I then uninstalled that
> version, downloaded a different installer, and tried again, but still
> no luck. I have not been able to find any alternative solution to the
> problem. The OS on both the old system and the new one is Windows 7
> Enterprise.
>
> Any assistance that anyone might be able to give would be much
> appreciated. I am not subscribed to the list, so please CC me on any
> replies. Thank you in advance for any assistance you may be able to
> give.
>
> --
> Parrish S. Knight
> NGS Help Desk Lead
> 301-713-3254 x184
> parrish.knight@noaa.gov