Package: subversion
Version: 1.6.17dfsg-2
Severity: important
Tags: security patch
Hi,
In its implementation of CRAM-MD5 authentication, svnserve uses
a challenge of
< nonce . time @ hostname >
After the fix to bug#285708, the nonce is not actually random, but is
just the current time a few moments before the later "time" component
is generated.
After intercepting a client's response to this challenge, I can reuse
that client's credentials, provided I am fast or lucky enough to time
my connection so as to get the same challenge (nonce and time).
The "nonce" and "time" are usually not equal and have fairly high
(1-tick --- usually 10-microsecond) resolution, so in practice this
might be hard to do. Even so, I would be happier with the following
patch applied.
More discussion (unfortunately not all of it productive) is at [1].
[1] http://thread.gmane.org/gmane.comp.version-control.subversion.devel/132267
---
debian/changelog | 9 +++++++++
debian/patches/entropy | 25 -------------------------
debian/patches/series | 1 -
3 files changed, 9 insertions(+), 26 deletions(-)
delete mode 100644 debian/patches/entropy
diff --git a/debian/changelog b/debian/changelog
index 8343f0ff..5dc86954 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+subversion (1.6.17dfsg-2.1) local; urgency=low
+
+ * Use apr_generate_random_bytes() instead of the current time in
+ microseconds to generate the nonce for CRAM-MD5 authentication (or
+ in other words, remove patches/entropy). This prevents a potential
+ replay attack. (Reopens: #285708)
+
+ -- Jonathan Nieder <[email protected]> Thu, 03 Nov 2011 13:13:28 -0500
+
subversion (1.6.17dfsg-2) unstable; urgency=low
* Standards-Version: 3.9.2. Also, multiarch.
diff --git a/debian/patches/entropy b/debian/patches/entropy
deleted file mode 100644
index 3c7ef060..00000000
--- a/debian/patches/entropy
+++ /dev/null
@@ -1,25 +0,0 @@
-#! /bin/sh /usr/share/dpatch/dpatch-run
-##
-## entropy by <[email protected]>
-##
-## DP: Changing the default behavior to not use apr_generate_random_bytes(),
Debian use
-## DP: the system APR which is configured to use /dev/random. In cases where
the
-## DP: entropy pool is drained svn commands can block waiting. Moving to the
fallback
-## DP: of using time. (Closes: #285708, #298822)
-
-@DPATCH@
---- a/subversion/libsvn_ra_svn/cram.c
-+++ b/subversion/libsvn_ra_svn/cram.c
-@@ -118,12 +118,8 @@
- * should prevent replay attacks in practice. */
- static apr_status_t make_nonce(apr_uint64_t *nonce)
- {
--#if APR_HAS_RANDOM
-- return apr_generate_random_bytes((unsigned char *) nonce, sizeof(*nonce));
--#else
- *nonce = apr_time_now();
- return APR_SUCCESS;
--#endif
- }
-
- svn_error_t *svn_ra_svn_cram_server(svn_ra_svn_conn_t *conn, apr_pool_t *pool,
diff --git a/debian/patches/series b/debian/patches/series
index 8508b6c0..7b78bd24 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,5 +1,4 @@
build-fixes
-entropy
java-build
last-changed-date-charset
no-extra-libs
--
1.7.8.rc0
--
To UNSUBSCRIBE, email to [email protected]
with a subject of "unsubscribe". Trouble? Contact [email protected]
