Test ID:	1.3.6.1.4.1.25623.1.0.50368
Category:	Fedora Local Security Checks
Title:	Fedora Core 2 FEDORA-2004-128 (subversion)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to subversion announced via advisory FEDORA-2004-128. Subversion is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. Subversion only stores the differences between versions, instead of every complete file. Subversion is intended to be a compelling replacement for CVS. Update Information: Stefan Esser discovered an issue in the date parsing routines in Subversion which allows a buffer overflow. An attacker could send malicious requests to a Subversion server (either Apache-based using mod_dav_svn, or using the svnserve daemon) and perform arbitrary execution of code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0397 to this issue. This update includes packages with a patch for this issue. This update can be downloaded from: http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/ 92cc070981eae85dc2220126a7cbd9d0 SRPMS/subversion-1.0.2-2.1.src.rpm 2ff7ecbf8f8c10b6ab761c3cbc913bf2 i386/subversion-1.0.2-2.1.i386.rpm a9e16d37859ee2168af5d2f0e53560a5 i386/subversion-devel-1.0.2-2.1.i386.rpm 6bd4b498f5c13bf4d2b2ad6668c86008 i386/mod_dav_svn-1.0.2-2.1.i386.rpm bfbbc9af5bbc287f74260bacb3bd3126 i386/subversion-perl-1.0.2-2.1.i386.rpm 8d4671361745f71e67310007ef8c6449 i386/debug/subversion-debuginfo-1.0.2-2.1.i386.rpm ca4fddfff4fff8a5496e29f3c314d32f x86_64/subversion-1.0.2-2.1.x86_64.rpm 0af6c873bcffd22fb0e1e4d60bcf1813 x86_64/subversion-devel-1.0.2-2.1.x86_64.rpm 9f8cef2892d8929b76f61562850e0648 x86_64/mod_dav_svn-1.0.2-2.1.x86_64.rpm 3e0bdc13b5fcd141416ec102b8608ac7 x86_64/subversion-perl-1.0.2-2.1.x86_64.rpm f7d2a0c88fcaeba74ef0bc9c9cb97dc9 x86_64/debug/subversion-debuginfo-1.0.2-2.1.x86_64.rpm This update can also be installed with the Update Agent you can launch the Update Agent with the 'up2date' command. Solution: Apply the appropriate updates. http://www.fedoranews.org/updates/FEDORA-2004-128.shtml Risk factor : High CVSS Score: 7.5
Cross-Ref:	BugTraq ID: 10386 Common Vulnerability Exposure (CVE) ID: CVE-2004-0397 http://www.securityfocus.com/bid/10386 Bugtraq: 20040519 Advisory 08/2004: Subversion remote vulnerability (Google Search) http://marc.info/?l=bugtraq&m=108498676517697&w=2 Bugtraq: 20040519 [OpenPKG-SA-2004.023] OpenPKG Security Advisory (subversion) (Google Search) http://www.securityfocus.com/archive/1/363814 http://www.linuxsecurity.com/advisories/fedora_advisory-4373.html https://bugzilla.fedora.us/show_bug.cgi?id=1748 http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/021737.html http://www.gentoo.org/security/en/glsa/glsa-200405-14.xml http://security.e-matters.de/advisories/082004.html http://www.osvdb.org/6301 http://secunia.com/advisories/11642 http://secunia.com/advisories/11675 XForce ISS Database: subversion-date-parsing-command-execution(16191) https://exchange.xforce.ibmcloud.com/vulnerabilities/16191
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.