ID de Prueba:	1.3.6.1.4.1.25623.1.0.69792
Categoría:	Red Hat Local Security Checks
Título:	RedHat Security Advisory RHSA-2011:0862
Resumen:	NOSUMMARY
Descripción:	Description: The remote host is missing updates announced in advisory RHSA-2011:0862. Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. The mod_dav_svn module is used with the Apache HTTP Server to allow access to Subversion repositories via HTTP. An infinite loop flaw was found in the way the mod_dav_svn module processed certain data sets. If the SVNPathAuthz directive was set to short_circuit, and path-based access control for files and directories was enabled, a malicious, remote user could use this flaw to cause the httpd process serving the request to consume an excessive amount of system memory. (CVE-2011-1783) A NULL pointer dereference flaw was found in the way the mod_dav_svn module processed requests submitted against the URL of a baselined resource. A malicious, remote user could use this flaw to cause the httpd process serving the request to crash. (CVE-2011-1752) An information disclosure flaw was found in the way the mod_dav_svn module processed certain URLs when path-based access control for files and directories was enabled. A malicious, remote user could possibly use this flaw to access certain files in a repository that would otherwise not be accessible to them. Note: This vulnerability cannot be triggered if the SVNPathAuthz directive is set to short_circuit. (CVE-2011-1921) Red Hat would like to thank the Apache Subversion project for reporting these issues. Upstream acknowledges Joe Schaefer of the Apache Software Foundation as the original reporter of CVE-2011-1752 Ivan Zhakov of VisualSVN as the original reporter of CVE-2011-1783 and Kamesh Jayachandran of CollabNet, Inc. as the original reporter of CVE-2011-1921. All Subversion users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, you must restart the httpd daemon, if you are using mod_dav_svn, for the update to take effect. Solution: Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date http://rhn.redhat.com/errata/RHSA-2011-0862.html http://subversion.apache.org/security/CVE-2011-1783-advisory.txt http://subversion.apache.org/security/CVE-2011-1752-advisory.txt http://subversion.apache.org/security/CVE-2011-1921-advisory.txt Risk factor : Medium CVSS Score: 5.0
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2011-1752 1025617 http://www.securitytracker.com/id?1025617 44633 http://secunia.com/advisories/44633 44681 http://secunia.com/advisories/44681 44849 http://secunia.com/advisories/44849 44879 http://secunia.com/advisories/44879 44888 http://secunia.com/advisories/44888 45162 http://secunia.com/advisories/45162 48091 http://www.securityfocus.com/bid/48091 APPLE-SA-2012-02-01-1 http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html DSA-2251 http://www.debian.org/security/2011/dsa-2251 FEDORA-2011-8341 http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062211.html FEDORA-2011-8352 http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061913.html MDVSA-2011:106 http://www.mandriva.com/security/advisories?name=MDVSA-2011:106 RHSA-2011:0861 http://www.redhat.com/support/errata/RHSA-2011-0861.html RHSA-2011:0862 http://www.redhat.com/support/errata/RHSA-2011-0862.html USN-1144-1 http://www.ubuntu.com/usn/USN-1144-1 http://subversion.apache.org/security/CVE-2011-1752-advisory.txt http://support.apple.com/kb/HT5130 http://svn.apache.org/repos/asf/subversion/tags/1.6.17/CHANGES https://bugzilla.redhat.com/show_bug.cgi?id=709111 oval:org.mitre.oval:def:18922 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18922 Common Vulnerability Exposure (CVE) ID: CVE-2011-1783 1025618 http://www.securitytracker.com/id?1025618 http://subversion.apache.org/security/CVE-2011-1783-advisory.txt https://bugzilla.redhat.com/show_bug.cgi?id=709112 oval:org.mitre.oval:def:18889 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18889 Common Vulnerability Exposure (CVE) ID: CVE-2011-1921 1025619 http://www.securitytracker.com/id?1025619 http://subversion.apache.org/security/CVE-2011-1921-advisory.txt https://bugzilla.redhat.com/show_bug.cgi?id=709114 oval:org.mitre.oval:def:18999 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18999 subversion-control-rules-info-disc(67804) https://exchange.xforce.ibmcloud.com/vulnerabilities/67804
Copyright	Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.