当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-057225

漏洞标题：腾讯某SVN服务器启用了OPENSSL TLS 可导致SVN账号密码泄露

相关厂商：腾讯

漏洞作者： 猪猪侠

提交时间：2014-04-15 23:25

修复时间：2014-04-16 09:21

公开时间：2014-04-16 09:21

漏洞类型：敏感信息泄露

危害等级：高

自评Rank：20

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-04-15： 细节已通知厂商并且等待厂商处理中
2014-04-16： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

互联网上大量Subversion服务器采用WebDav+OpenSSL进行认证
腾讯某SVN服务器启用了OPENSSL TLS,可导致SVN账号密码泄露
SVN账号密码泄露，将代表源码间接被读取，被二次放大利用，危害将非常严重。

详细说明：

#1 服务器信息
服务器IP：183.60.118.90
https://183.60.118.90

漏洞证明：

#2 泄露信息

.@....SC[...r....+..H...9........w.3....f.....".!.9.8.........5.............................3.2.....E.D...../...A.................................I...........4.2...................................................#....... text/xml..Accept-Encoding: gzip..DAV: http://subversion.tigris.org/xmlns/dav/svn/depth..DAV: http://subversion.tigris.org/xmlns/dav/svn/mergeinfo..DAV: http://subversion.tigris.org/xmlns/dav/svn/log-revprops..Content-Length: 104..Accept-Encoding: gzip..Authorization: Basic YnVpbGRlcjpidWlsZGVy........1?/|n.3o.V............C..Zv..ga.z!......................w.5........0..0...U......k......,..e.5...}.".0....U.#...0....k......,..e.5...}.".......0..1.0...U....CN1.0...U....SH1.0...U....SH1.0...U....Tencent1.0...U....APP1.0...U....svn.vendor.com1'0%..*.H........phillipzhang@tencent.com....JbQ'...0...U....0....0...*.H................1.|.....*.}@.....{.m...d./.....%6S.....U.d..r..,8%.l...J.RE.P.....*#"..bM-.m`.:h..ogc.....Y.....qW..-".8j..66$.`&......z.l{.............}.@....6...J......9._R...t....Q....c.r......~..Z.y.B.*).2JFzc^..Y.7{...3..F..;r....x.[....xt.}.......3...b....t}.....h..9>.$!.......\8......E..........QEw,I...F,hz.....C&..,F...RfC.f.h....JwU.\.....$.....iq.....8x.....P|.. [.%.*....xA.*....Z..........#..X5........A.U.....+cY...c.u|C.\.......@F.g.......z..U......~..W.<..*...K.Y.+xp.2...1.u..FQ......G...x.V.x`a..MY.@.4.{...J.. ...M..h<vl.zQ...........r.Yj.m../...?Q.e...7......~q..mW*..+Y.a/.9W...0.&nO...2.... .g!A..:.T=.'.<...o.^...s/.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................Q...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

修复方案：

补丁

版权声明：转载请注明来源 猪猪侠@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2014-04-16 09:21

厂商回复：

非常感谢您的反馈。该问题已经通过其它渠道发现，并于9号修复完毕。如您有进一步发现，请及时与我们联系，我们会有专人跟进处理。

漏洞Rank：8 (WooYun评价)

最新状态：

暂无