oss-sec mailing list archives
Re: Re: Possible CVE request: subversion MD5 collision authentication leak
From: Ben Reser <ben () reser org>
Date: Mon, 04 Aug 2014 15:32:13 -0700
On 8/4/14 12:38 PM, Tomas Hoger wrote:
I believe the attack here is supposed to create a collision against MD5 sums used as names of files under ~/.subversion/auth/svn.simple/. However, as attacker does not control realm strings for any of the trusted repositories, that would require preimage attack. The lack of (publicly) known efficient preimage attacks against MD5 should imply such attack is still only theoretical.
I think your understanding of the current state of MD5 collision attacks is out of date. Chosen prefix attacks are possible. See: http://www.win.tue.nl/hashclash/ChosenPrefixCollisions/ The MD5 hash is created off the data in the following format: <$URL> $REALM An attacker trying to take advantage of this only needs the $URL portion to match their server. The $REALM can then be whatever data is required to make the MD5 hash match the system they are trying to attack. I know of nobody that has taken the time to generate a MD5 collision to take advantage of this. But I'm pretty sure that it could be done.
Current thread:
- Possible CVE request: subversion MD5 collision authentication leak Marcus Meissner (Aug 01)
- Re: Possible CVE request: subversion MD5 collision authentication leak Ben Reser (Aug 01)
- Re: Re: Possible CVE request: subversion MD5 collision authentication leak Tomas Hoger (Aug 04)
- Re: Re: Possible CVE request: subversion MD5 collision authentication leak Ben Reser (Aug 04)
- Re: Re: Possible CVE request: subversion MD5 collision authentication leak Michael Samuel (Aug 04)
- Re: Re: Possible CVE request: subversion MD5 collision authentication leak Tomas Hoger (Aug 04)
- Re: Possible CVE request: subversion MD5 collision authentication leak Ben Reser (Aug 01)
- <Possible follow-ups>
- Re: Re: Possible CVE request: subversion MD5 collision authentication leak Ben Reser (Aug 05)