ID de Prueba:	1.3.6.1.4.1.25623.1.0.881897
Categoría:	CentOS Local Security Checks
Título:	CentOS Update for mod_dav_svn CESA-2014:0255 centos6
Resumen:	The remote host is missing an update for the 'mod_dav_svn'; package(s) announced via the referenced advisory.
Descripción:	Summary: The remote host is missing an update for the 'mod_dav_svn' package(s) announced via the referenced advisory. Vulnerability Insight: Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. The mod_dav_svn module is used with the Apache HTTP Server to allow access to Subversion repositories via HTTP. A flaw was found in the way the mod_dav_svn module handled OPTIONS requests. A remote attacker with read access to an SVN repository served via HTTP could use this flaw to cause the httpd process that handled such a request to crash. (CVE-2014-0032) A flaw was found in the way Subversion handled file names with newline characters when the FSFS repository format was used. An attacker with commit access to an SVN repository could corrupt a revision by committing a specially crafted file. (CVE-2013-1968) A flaw was found in the way the svnserve tool of Subversion handled remote client network connections. An attacker with read access to an SVN repository served via svnserve could use this flaw to cause the svnserve daemon to exit, leading to a denial of service. (CVE-2013-2112) All subversion users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, for the update to take effect, you must restart the httpd daemon, if you are using mod_dav_svn, and the svnserve daemon, if you are serving Subversion repositories via the svn:// protocol. Affected Software/OS: mod_dav_svn on CentOS 6 Solution: Please install the updated packages. CVSS Score: 7.8 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2013-1968 Debian Security Information: DSA-2703 (Google Search) http://www.debian.org/security/2013/dsa-2703 http://mail-archives.apache.org/mod_mbox/subversion-announce/201305.mbox/%3CCADkdwvRK51pQsybfvsAzjxQJrmVpL0fEa1K4WGkUP9Tzz6KFDw%40mail.gmail.com%3E http://mail-archives.apache.org/mod_mbox/subversion-announce/201305.mbox/%3CCADkdwvTxsMFeHgc8bK2V-2PrSrKoBffTi8%2BxbHA5tocrrewWew%40mail.gmail.com%3E https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18986 RedHat Security Advisories: RHSA-2014:0255 http://rhn.redhat.com/errata/RHSA-2014-0255.html SuSE Security Announcement: openSUSE-SU-2013:1139 (Google Search) http://lists.opensuse.org/opensuse-updates/2013-07/msg00015.html http://www.ubuntu.com/usn/USN-1893-1 Common Vulnerability Exposure (CVE) ID: CVE-2013-2112 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19057 Common Vulnerability Exposure (CVE) ID: CVE-2014-0032 BugTraq ID: 65434 http://www.securityfocus.com/bid/65434 https://security.gentoo.org/glsa/201610-05 http://mail-archives.apache.org/mod_mbox/subversion-dev/201401.mbox/%3C52D328AB.8090502@reser.org%3E http://mail-archives.apache.org/mod_mbox/subversion-dev/201401.mbox/%3C871u0gqb0d.fsf@ntlworld.com%3E http://mail-archives.apache.org/mod_mbox/subversion-dev/201401.mbox/%3CCANvU9scLHr2yOLABW8q6_wNzhEf7pWM=NiavGcobqvUuyhKyAA@mail.gmail.com%3E http://www.osvdb.org/102927 http://secunia.com/advisories/56822 http://secunia.com/advisories/60722 http://secunia.com/advisories/61321 SuSE Security Announcement: openSUSE-SU-2014:0307 (Google Search) http://lists.opensuse.org/opensuse-updates/2014-02/msg00086.html SuSE Security Announcement: openSUSE-SU-2014:0334 (Google Search) http://lists.opensuse.org/opensuse-updates/2014-03/msg00011.html http://www.ubuntu.com/usn/USN-2316-1 XForce ISS Database: apache-subversion-cve20140032-dos(90986) https://exchange.xforce.ibmcloud.com/vulnerabilities/90986
Copyright	Copyright (C) 2014 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.