Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.871313
Category:Red Hat Local Security Checks
Title:RedHat Update for subversion RHSA-2015:0166-01
Summary:The remote host is missing an update for the 'subversion'; package(s) announced via the referenced advisory.
Description:Summary:
The remote host is missing an update for the 'subversion'
package(s) announced via the referenced advisory.

Vulnerability Insight:
Subversion (SVN) is a concurrent version control system which enables one
or more users to collaborate in developing and maintaining a hierarchy of
files and directories while keeping a history of all changes. The
mod_dav_svn module is used with the Apache HTTP Server to allow access
to Subversion repositories via HTTP.

A NULL pointer dereference flaw was found in the way the mod_dav_svn module
handled REPORT requests. A remote, unauthenticated attacker could use a
specially crafted REPORT request to crash mod_dav_svn. (CVE-2014-3580)

A NULL pointer dereference flaw was found in the way the mod_dav_svn module
handled certain requests for URIs that trigger a lookup of a virtual
transaction name. A remote, unauthenticated attacker could send a request
for a virtual transaction name that does not exist, causing mod_dav_svn to
crash. (CVE-2014-8108)

It was discovered that Subversion clients retrieved cached authentication
credentials using the MD5 hash of the server realm string without also
checking the server's URL. A malicious server able to provide a realm that
triggers an MD5 collision could possibly use this flaw to obtain the
credentials for a different realm. (CVE-2014-3528)

Red Hat would like to thank the Subversion project for reporting
CVE-2014-3580 and CVE-2014-8108. Upstream acknowledges Evgeny Kotkov of
VisualSVN as the original reporter.

All subversion users should upgrade to these updated packages, which
contain backported patches to correct these issues. After installing the
updated packages, for the update to take effect, you must restart the httpd
daemon, if you are using mod_dav_svn, and the svnserve daemon, if you are
serving Subversion repositories via the svn:// protocol.

Affected Software/OS:
subversion on Red Hat Enterprise Linux Server (v. 7)

Solution:
Please Install the Updated Packages.

CVSS Score:
5.0

CVSS Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:P

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2014-3528
http://lists.apple.com/archives/security-announce/2015/Mar/msg00003.html
BugTraq ID: 68995
http://www.securityfocus.com/bid/68995
https://security.gentoo.org/glsa/201610-05
RedHat Security Advisories: RHSA-2015:0165
http://rhn.redhat.com/errata/RHSA-2015-0165.html
RedHat Security Advisories: RHSA-2015:0166
http://rhn.redhat.com/errata/RHSA-2015-0166.html
http://secunia.com/advisories/59432
http://secunia.com/advisories/59584
http://secunia.com/advisories/60722
SuSE Security Announcement: openSUSE-SU-2014:1059 (Google Search)
http://lists.opensuse.org/opensuse-updates/2014-08/msg00038.html
http://www.ubuntu.com/usn/USN-2316-1
Common Vulnerability Exposure (CVE) ID: CVE-2014-3580
BugTraq ID: 71726
http://www.securityfocus.com/bid/71726
Debian Security Information: DSA-3107 (Google Search)
http://www.debian.org/security/2014/dsa-3107
http://secunia.com/advisories/61131
http://www.ubuntu.com/usn/USN-2721-1
Common Vulnerability Exposure (CVE) ID: CVE-2014-8108
BugTraq ID: 71725
http://www.securityfocus.com/bid/71725
CopyrightCopyright (C) 2015 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.