vendor:
Subversion
by:
greuff
N/A
CVSS
N/A
Remote exploit against Subversion-Servers
Unknown
CWE
Product Name: Subversion
Affected Version From: Subversion 1.0.0
Affected Version To: Subversion 0.37
Patch Exists: Unknown
Related CWE:
CPE: Unknown
Platforms Tested:
Unknown
hoagie_subversion.c
This is a two-stage exploit. The first stage overflows a buffer on the stack and leaves us ~60 bytes of machine code to be executed. The exploit then sends the second stage loader to the server, which can be of any length. This second stage loader spawns /bin/sh on the server and connects it to the socket-fd.
Mitigation:
Unknown