Svnserve DoS

--f46d041556dce2867904b136bff6
Content-Type: text/plain; charset=ISO-8859-1

Hello,

(firstly I apologise for mailing to both lists simultaneously but this
concerns both products)

One of our developers accidentaly stumbled upon an effective way to DoS the
whole server by unknowingly trying to access parts of SVN repo he was not
authorized for. The svnserve daemon spawned a child which replied with
"authorization error", but developer's client (TortoiseSVN) just created
new connection and tried again, in a loop. For unknown reason, it also did
not close previous connection and this resulted in creation of several
thousand svnserve processes and server crash due to exhausted RAM issue.

SVN server was running in standalone mode, version 1.7.1.
Client has TortoiseSVN version 1.7.0.

I have two questions:

1.) is this a known server issue and is there a way to limit number of
processes svnserve creates in standalone mode? (we've switched ti xinetd
currently to prevent DoS)

2.) is this a known client issue?


Best regards,
b.

--f46d041556dce2867904b136bff6
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Hello,<br><br>(firstly I apologise for mailing to both lists simultaneously=
 but this concerns both products)<br><br>One of our developers accidentaly =
stumbled upon an effective way to DoS the whole server by unknowingly tryin=
g to access parts of SVN repo he was not authorized for. The svnserve daemo=
n spawned a child which replied with &quot;authorization error&quot;, but d=
eveloper&#39;s client (TortoiseSVN) just created new connection and tried a=
gain, in a loop. For unknown reason, it also did not close previous connect=
ion and this resulted in creation of several thousand svnserve processes an=
d server crash due to exhausted RAM issue.<br>
<br>SVN server was running in standalone mode, version 1.7.1.<br>Client has=
 TortoiseSVN version 1.7.0.<br><br>I have two questions:<br><br>1.) is this=
 a known server issue and is there a way to limit number of processes svnse=
rve creates in standalone mode? (we&#39;ve switched ti xinetd currently to =
prevent DoS)<br>
<br>2.) is this a known client issue?<br><br><br>Best regards,<br>b.<br><br=
>

--f46d041556dce2867904b136bff6--