Test ID:	1.3.6.1.4.1.25623.1.0.68459
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-2118-1)
Summary:	The remote host is missing an update for the Debian 'subversion' package(s) announced via the DSA-2118-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'subversion' package(s) announced via the DSA-2118-1 advisory. Vulnerability Insight: Kamesh Jayachandran and C. Michael Pilat discovered that the mod_dav_svn module of Subversion, a version control system, is not properly enforcing access rules which are scope-limited to named repositories. If the SVNPathAuthz option is set to short_circuit set this may enable an unprivileged attacker to bypass intended access restrictions and disclose or modify repository content. As a workaround it is also possible to set SVNPathAuthz to on but be advised that this can result in a performance decrease for large repositories. For the stable distribution (lenny), this problem has been fixed in version 1.5.1dfsg1-5. For the testing distribution (squeeze), this problem has been fixed in version 1.6.12dfsg-2. For the unstable distribution (sid), this problem has been fixed in version 1.6.12dfsg-2. We recommend that you upgrade your subversion packages. Affected Software/OS: 'subversion' package(s) on Debian 5. Solution: Please install the updated package(s). CVSS Score: 6.0 CVSS Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2010-3315 41652 http://secunia.com/advisories/41652 43139 http://secunia.com/advisories/43139 43346 http://secunia.com/advisories/43346 ADV-2011-0264 http://www.vupen.com/english/advisories/2011/0264 APPLE-SA-2011-03-21-1 http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html DSA-2118 http://www.debian.org/security/2010/dsa-2118 MDVSA-2010:199 http://www.mandriva.com/security/advisories?name=MDVSA-2010:199 RHSA-2011:0258 http://www.redhat.com/support/errata/RHSA-2011-0258.html SUSE-SR:2010:024 http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html USN-1053-1 http://www.ubuntu.com/usn/USN-1053-1 http://security-tracker.debian.org/tracker/CVE-2010-3315 http://subversion.apache.org/security/CVE-2010-3315-advisory.txt http://support.apple.com/kb/HT4581 oval:org.mitre.oval:def:19007 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19007
Copyright	Copyright (C) 2010 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.