Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1.0.2 and earlier allows remote attackers to execute arbitrary code via a (1) DAV2 REPORT query or (2) get-dated-rev svn-protocol command.

Stefan Esser reports :

Subversion versions up to 1.0.2 are vulnerable to a date parsing vulnerability which can be abused to allow remote code execution on Subversion servers and therefore could lead to a repository compromise.

NOTE: This vulnerability is similar to the date parsing issue that affected neon. However, it is a different and distinct bug.

The remote host is affected by the vulnerability described in GLSA-200405-14 (Buffer overflow in Subversion)

    All releases of Subversion prior to 1.0.3 have a vulnerability in the     date-parsing code. This vulnerability may allow denial of service or     arbitrary code execution as the Subversion user. Both the client and     server are vulnerable, and write access is NOT required to the server's     repository.
  Impact :

    All servers and clients are vulnerable. Specifically, clients that     allow other users to write to administrative files in a working copy     may be exploited. Additionally all servers (whether they are httpd/DAV     or svnserve) are vulnerable. Write access to the server is not     required; public read-only Subversion servers are also exploitable.
  Workaround :

    There is no known workaround at this time. All users are encouraged to     upgrade to the latest available version.

The remote host is running subversion, an open-source file management product.  According to the version number, the remote system is vulnerable to at least one remote buffer overflow. 

The remote host is running Subversion, an open-source file management product.  According to the version number, the remote system is vulnerable to at least one remote buffer overflow. 

Stefan Esser discovered an issue in the date parsing routines in Subversion which allows a buffer overflow. An attacker could send malicious requests to a Subversion server (either Apache-based using mod_dav_svn, or using the svnserve daemon) and perform arbitrary execution of code. 

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0397 to this issue. This update includes packages with a patch for this issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is vulnerable to a remote stack-based overflow.  An attacker, exploiting this hole, would be given full access to the target machine.  Versions of Subversion less than 1.0.3 are vulnerable to this attack.
This vulnerability was discovered by Stefan Esser and posted to public mailing lists.

ID	Name	Product	Family	Severity
36673	FreeBSD : subversion date parsing vulnerability (5d36ef32-a9cf-11d8-9c6d-0020ed76ef5a)	Nessus	FreeBSD Local Security Checks	high
14500	GLSA-200405-14 : Buffer overflow in Subversion	Nessus	Gentoo Local Security Checks	high
1227	Subversion (SVN) apr_time_t Data Conversion Remote Overflow (deprecated)	Nessus Network Monitor	Generic	high
2117	Subversion (SVN) < 1.0.3 Remote Buffer Overflow (deprecated)	Nessus Network Monitor	Generic	high
13703	Fedora Core 2 : subversion-1.0.2-2.1 (2004-128)	Nessus	Fedora Local Security Checks	high
13702	Fedora Core 1 : subversion-0.32.1-2 (2004-127)	Nessus	Fedora Local Security Checks	high
12261	Subversion < 1.0.3 apr_time_t data Conversion Remote Overflow	Nessus	Misc.	high

Detections

Analytics

CVE-2004-0397

critical

Tenable Plugins

high

high

high

high

high

high

high