| Description: | Summary:
The remote host is missing an update to the system
as announced in the referenced advisory.
Vulnerability Insight:
The following packages are affected:
subversion
subversion-freebsd
CVE-2011-1752
The mod_dav_svn module for the Apache HTTP Server, as distributed in
Apache Subversion before 1.6.17, allows remote attackers to cause a
denial of service (NULL pointer dereference and daemon crash) via a
request for a baselined WebDAV resource, as exploited in the wild in
May 2011.
CVE-2011-1783
The mod_dav_svn module for the Apache HTTP Server, as distributed in
Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz
short_circuit option is enabled, allows remote attackers to cause a
denial of service (infinite loop and memory consumption) in
opportunistic circumstances by requesting data.
CVE-2011-1921
The mod_dav_svn module for the Apache HTTP Server, as distributed in
Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz
short_circuit option is disabled, does not properly enforce
permissions for files that had been publicly readable in the past,
which allows remote attackers to obtain sensitive information via a
replay REPORT operation.
Solution:
Update your system with the appropriate patches or
software upgrades.
CVSS Score:
5.0
CVSS Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:P
|
