libsvn_ra_svn in Subversion 1.0.4 trusts the length field of (1) svn://, (2) svn+ssh://, and (3) other svn protocol URL strings, which allows remote attackers to cause a denial of service (memory consumption) and possibly execute arbitrary code via an integer overflow that leads to a heap-based buffer overflow.

The remote host is affected by the vulnerability described in GLSA-200406-07 (Subversion: Remote heap overflow)

    The svn protocol parser trusts the indicated length of a URI string sent by     a client. This allows a client to specify a very long string, thereby     causing svnserve to allocate enough memory to hold that string. This may     cause a Denial of Service. Alternately, given a string that causes an     integer overflow in the variable holding the string length, the server     might allocate less memory than required, allowing a heap overflow. This     heap overflow may then be exploitable, allowing remote code execution. The     attacker does not need read or write access to the Subversion repository     being served, since even un-authenticated users can send svn protocol     requests.
  Impact :

    Ranges from remote Denial of Service to potential arbitrary code execution     with privileges of the svnserve process.
  Workaround :

    Servers without svnserve running are not vulnerable. Disable svnserve and     use DAV for access instead.

The remote host is missing the patch for the advisory SuSE-SA:2004:018 (subversion).


Subversion is a version control system like the well known CVS.
The subversion code is vulnerable to a remotely exploitable buffer overflow on the heap. The bug appears before any authentication took place. An attacker is able to execute arbitrary code by abusing this vulnerability.

There is no temporary workaround known.

Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement.
Then, install the package using the command 'rpm -Fhv file.rpm' to apply the update.

A heap overflow vulnerability was discovered in the svn:// protocol handling library, libsvn_ra_svn. If using the svnserve daemon, an unauthenticated client may be able execute arbitrary code as the user the daemon runs as. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0413. This issue does not affect the mod_dav_svn module.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A remote overflow exists in Subversion. svnserver fails to validate svn:// requests resulting in a heap overflow. With a specially crafted request, an attacker can cause arbitrary code execution resulting in a loss of integrity.

ID	Name	Product	Family	Severity
14518	GLSA-200406-07 : Subversion: Remote heap overflow	Nessus	Gentoo Local Security Checks	critical
13834	SuSE-SA:2004:018: subversion	Nessus	SuSE Local Security Checks	critical
13719	Fedora Core 1 : subversion-0.32.1-5 (2004-165)	Nessus	Fedora Local Security Checks	critical
12284	Subversion < 1.0.5 svnserver svn:// Protocol Handler Remote Overflow	Nessus	Misc.	critical

Detections

Analytics

CVE-2004-0413

critical

Tenable Plugins

critical

critical

critical

critical