Subversion 1.4.3 and earlier does not properly implement the "partial access" privilege for users who have access to changed paths but not copied paths, which allows remote authenticated users to obtain sensitive information (revision properties) via svn (1) propget, (2) proplist, or (3) propedit.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - subversion: revision properties disclosure to user with partial access (CVE-2007-2448)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

It was discovered that Subversion incorrectly handled certain 'partial access' privileges in rare scenarios. Remote authenticated users could use this flaw to obtain sensitive information (revision properties).
This issue only applied to Ubuntu 6.06 LTS. (CVE-2007-2448)

It was discovered that the Subversion mod_dav_svn module for Apache did not properly handle a named repository as a rule scope. Remote authenticated users could use this flaw to bypass intended restrictions. This issue only applied to Ubuntu 9.10, 10.04 LTS, and 10.10. (CVE-2010-3315)

It was discovered that the Subversion mod_dav_svn module for Apache incorrectly handled the walk function. Remote authenticated users could use this flaw to cause the service to crash, leading to a denial of service. (CVE-2010-4539)

It was discovered that Subversion incorrectly handled certain memory operations. Remote authenticated users could use this flaw to consume large quantities of memory and cause the service to crash, leading to a denial of service. This issue only applied to Ubuntu 9.10, 10.04 LTS, and 10.10. (CVE-2010-4644).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update includes the Subversion 1.4.4 release, including a number of bug fixes and a fix for a minor security issue.

An issue was discovered in the implementation of access control for revision properties in the path-based authorization code. In a repository using path-based access control, if a path was copied from a private area to a public area, the revision properties of the (private) source path would become visible despite the access control restrictions. (CVE-2007-2448)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199211	RHEL 4 : subversion (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
51846	Ubuntu 6.06 LTS / 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : subversion vulnerabilities (USN-1053-1)	Nessus	Ubuntu Local Security Checks	medium
27782	Fedora 7 : subversion-1.4.4-1.fc7 (2007-2635)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2007-2448

medium

Tenable Plugins

medium

medium

low