Test ID:	1.3.6.1.4.1.25623.1.0.881360
Category:	CentOS Local Security Checks
Title:	CentOS Update for mod_dav_svn CESA-2011:0862 centos5 x86_64
Summary:	The remote host is missing an update for the 'mod_dav_svn'; package(s) announced via the referenced advisory.
Description:	Summary: The remote host is missing an update for the 'mod_dav_svn' package(s) announced via the referenced advisory. Vulnerability Insight: Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. The mod_dav_svn module is used with the Apache HTTP Server to allow access to Subversion repositories via HTTP. An infinite loop flaw was found in the way the mod_dav_svn module processed certain data sets. If the SVNPathAuthz directive was set to 'short_circuit', and path-based access control for files and directories was enabled, a malicious, remote user could use this flaw to cause the httpd process serving the request to consume an excessive amount of system memory. (CVE-2011-1783) A NULL pointer dereference flaw was found in the way the mod_dav_svn module processed requests submitted against the URL of a baselined resource. A malicious, remote user could use this flaw to cause the httpd process serving the request to crash. (CVE-2011-1752) An information disclosure flaw was found in the way the mod_dav_svn module processed certain URLs when path-based access control for files and directories was enabled. A malicious, remote user could possibly use this flaw to access certain files in a repository that would otherwise not be accessible to them. Note: This vulnerability cannot be triggered if the SVNPathAuthz directive is set to 'short_circuit'. (CVE-2011-1921) Red Hat would like to thank the Apache Subversion project for reporting these issues. Upstream acknowledges Joe Schaefer of the Apache Software Foundation as the original reporter of CVE-2011-1752, Ivan Zhakov of VisualSVN as the original reporter of CVE-2011-1783, and Kamesh Jayachandran of CollabNet, Inc. as the original reporter of CVE-2011-1921. All Subversion users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, you must restart the httpd daemon, if you are using mod_dav_svn, for the update to take effect. Affected Software/OS: mod_dav_svn on CentOS 5 Solution: Please install the updated packages. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2011-1752 1025617 http://www.securitytracker.com/id?1025617 44633 http://secunia.com/advisories/44633 44681 http://secunia.com/advisories/44681 44849 http://secunia.com/advisories/44849 44879 http://secunia.com/advisories/44879 44888 http://secunia.com/advisories/44888 45162 http://secunia.com/advisories/45162 48091 http://www.securityfocus.com/bid/48091 APPLE-SA-2012-02-01-1 http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html DSA-2251 http://www.debian.org/security/2011/dsa-2251 FEDORA-2011-8341 http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062211.html FEDORA-2011-8352 http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061913.html MDVSA-2011:106 http://www.mandriva.com/security/advisories?name=MDVSA-2011:106 RHSA-2011:0861 http://www.redhat.com/support/errata/RHSA-2011-0861.html RHSA-2011:0862 http://www.redhat.com/support/errata/RHSA-2011-0862.html USN-1144-1 http://www.ubuntu.com/usn/USN-1144-1 http://subversion.apache.org/security/CVE-2011-1752-advisory.txt http://support.apple.com/kb/HT5130 http://svn.apache.org/repos/asf/subversion/tags/1.6.17/CHANGES https://bugzilla.redhat.com/show_bug.cgi?id=709111 oval:org.mitre.oval:def:18922 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18922 Common Vulnerability Exposure (CVE) ID: CVE-2011-1783 1025618 http://www.securitytracker.com/id?1025618 http://subversion.apache.org/security/CVE-2011-1783-advisory.txt https://bugzilla.redhat.com/show_bug.cgi?id=709112 oval:org.mitre.oval:def:18889 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18889 Common Vulnerability Exposure (CVE) ID: CVE-2011-1921 1025619 http://www.securitytracker.com/id?1025619 http://subversion.apache.org/security/CVE-2011-1921-advisory.txt https://bugzilla.redhat.com/show_bug.cgi?id=709114 oval:org.mitre.oval:def:18999 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18999 subversion-control-rules-info-disc(67804) https://exchange.xforce.ibmcloud.com/vulnerabilities/67804
Copyright	Copyright (C) 2012 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.