authz.c in the mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x before 1.5.8 and 1.6.x before 1.6.13, when SVNPathAuthz short_circuit is enabled, does not properly handle a named repository as a rule scope, which allows remote authenticated users to bypass intended access restrictions via svn commands.

when using 'SVNPathAuthz short_circuit' mod_dav_svn didn't properly enforce access restrictions (CVE-2010-3315).

From Red Hat Security Advisory 2011:0258 :

Updated subversion packages that fix three security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. The mod_dav_svn module is used with the Apache HTTP Server to allow access to Subversion repositories via HTTP.

An access restriction bypass flaw was found in the mod_dav_svn module.
If the SVNPathAuthz directive was set to 'short_circuit', certain access rules were not enforced, possibly allowing sensitive repository data to be leaked to remote users. Note that SVNPathAuthz is set to 'On' by default. (CVE-2010-3315)

A server-side memory leak was found in the Subversion server. If a malicious, remote user performed 'svn blame' or 'svn log' operations on certain repository files, it could cause the Subversion server to consume a large amount of system memory. (CVE-2010-4644)

A NULL pointer dereference flaw was found in the way the mod_dav_svn module processed certain requests. If a malicious, remote user issued a certain type of request to display a collection of Subversion repositories on a host that has the SVNListParentPath directive enabled, it could cause the httpd process serving the request to crash. Note that SVNListParentPath is not enabled by default.
(CVE-2010-4539)

All Subversion users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the Subversion server must be restarted for the update to take effect: restart httpd if you are using mod_dav_svn, or restart svnserve if it is used.

An access restriction bypass flaw was found in the mod_dav_svn module.
If the SVNPathAuthz directive was set to 'short_circuit', certain access rules were not enforced, possibly allowing sensitive repository data to be leaked to remote users. Note that SVNPathAuthz is set to 'On' by default. (CVE-2010-3315)

A server-side memory leak was found in the Subversion server. If a malicious, remote user performed 'svn blame' or 'svn log' operations on certain repository files, it could cause the Subversion server to consume a large amount of system memory. (CVE-2010-4644)

A NULL pointer dereference flaw was found in the way the mod_dav_svn module processed certain requests. If a malicious, remote user issued a certain type of request to display a collection of Subversion repositories on a host that has the SVNListParentPath directive enabled, it could cause the httpd process serving the request to crash. Note that SVNListParentPath is not enabled by default.
(CVE-2010-4539)

After installing the updated packages, the Subversion server must be restarted for the update to take effect: restart httpd if you are using mod_dav_svn, or restart svnserve if it is used.

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.7.

Mac OS X 10.6.7 contains security fixes for the following products :

  - AirPort
  - Apache
  - AppleScript
  - ATS
  - bzip2
  - CarbonCore
  - ClamAV
  - CoreText
  - File Quarantine
  - HFS
  - ImageIO
  - Image RAW
  - Installer
  - Kerberos
  - Kernel
  - Libinfo
  - libxml
  - Mailman
  - PHP
  - QuickLook
  - QuickTime
  - Ruby
  - Samba
  - Subversion
  - Terminal
  - X11

Versions of Mac OS X 10.6 earlier than 10.6.7 are potentially affected by a security issue.  Mac OS X 10.6.7 contains a security fix for the following products :

  - Airport

  - Apache

  - AppleScript

  - ATS

  - bzip2

  - CarbonCore

  - ClamAV

  - CoreText

  - HFS

  - ImageIO

  - Image RAW

  - Installer

  - Kerberos

  - Kernel

  - Libinfo

  - libxml

  - Mailman

  - PHP

  - QuickLook

  - QuickTime

  - Ruby

  - Samba

  - Subversion

  - Terminal

  - X11
IAVB Reference : 2010-B-0083
STIG Finding Severity : Category II

Versions of Mac OS X 10.6 earlier than 10.6.7 are potentially affected by a security issue.  Mac OS X 10.6.7 contains a security fix for the following products :

  - Airport

  - Apache

  - AppleScript

  - ATS

  - bzip2

  - CarbonCore

  - ClamAV

  - CoreText

  - HFS

  - ImageIO

  - Image RAW

  - Installer

  - Kerberos

  - Kernel

  - Libinfo

  - libxml

  - Mailman

  - PHP

  - QuickLook

  - QuickTime

  - Ruby

  - Samba

  - Subversion

  - Terminal

  - X11

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0258 advisory.

  - Subversion: Access restriction bypass by checkout of the root of the repository (CVE-2010-3315)

  - Subversion (mod_dav_svn): DoS (crash) by processing certain requests to display all available repositories     to a web browser (CVE-2010-4539)

  - Subversion: DoS (memory consumption) by processing blame or log -g requests on certain files     (CVE-2010-4644)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that Subversion incorrectly handled certain 'partial access' privileges in rare scenarios. Remote authenticated users could use this flaw to obtain sensitive information (revision properties).
This issue only applied to Ubuntu 6.06 LTS. (CVE-2007-2448)

It was discovered that the Subversion mod_dav_svn module for Apache did not properly handle a named repository as a rule scope. Remote authenticated users could use this flaw to bypass intended restrictions. This issue only applied to Ubuntu 9.10, 10.04 LTS, and 10.10. (CVE-2010-3315)

It was discovered that the Subversion mod_dav_svn module for Apache incorrectly handled the walk function. Remote authenticated users could use this flaw to cause the service to crash, leading to a denial of service. (CVE-2010-4539)

It was discovered that Subversion incorrectly handled certain memory operations. Remote authenticated users could use this flaw to consume large quantities of memory and cause the service to crash, leading to a denial of service. This issue only applied to Ubuntu 9.10, 10.04 LTS, and 10.10. (CVE-2010-4644).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update includes the latest stable release of Subversion, version 1.6.13.

Subversion servers up to 1.6.12 (inclusive) making use of the 'SVNPathAuthz short_circuit' mod_dav_svn configuration setting have a bug which may allow users to write and/or read portions of the repository to which they are not intended to have access. This issue is fixed in this update.

See http://subversion.apache.org/security/CVE-2010-3315-advisory.txt for further details

A number of bug fixes are also included :

  - don't drop properties during foreign-repo merges

    - improve auto-props failure error message

    - improve error message for 403 status with ra_neon

    - don't allow 'merge --reintegrate' for 2-url merges

    - improve handling of missing fsfs.conf during hotcopy

    - escape unsafe characters in a URL during export

    - don't leak stale locks in FSFS

    - better detect broken working copies during update over       ra_neon

    - fsfs: make rev files read-only

    - properly canonicalize a URL

    - fix wc corruption with 'commit --depth=empty'

    - permissions fixes when doing reintegrate merges

    - fix mergeinfo miscalculation during 2-url merges

    - fix error transmission problems in svnserve

    - fixed: record-only merges create self-referential       mergeinfo

    - make 'svnmucc propset' handle existing and       non-existing URLs

    - add new 'propsetf' subcommand to svnmucc

    - emit a warning about copied dirs during ci with       limited depth

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability was discovered and corrected in subversion :

authz.c in the mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x before 1.5.8 and 1.6.x before 1.6.13, when SVNPathAuthz short_circuit is enabled, does not properly handle a named repository as a rule scope, which allows remote authenticated users to bypass intended access restrictions via svn commands (CVE-2010-3315).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

The updated packages have been patched to correct this issue.

Kamesh Jayachandran and C. Michael Pilat discovered that the mod_dav_svn module of Subversion, a version control system, is not properly enforcing access rules which are scope-limited to named repositories. If the SVNPathAuthz option is set to 'short_circuit' set this may enable an unprivileged attacker to bypass intended access restrictions and disclose or modify repository content.

ID	Name	Product	Family	Severity
75615	openSUSE Security Update : libsvn_auth_gnome_keyring-1-0 (openSUSE-SU-2010:1042-1)	Nessus	SuSE Local Security Checks	medium
68200	Oracle Linux 6 : subversion (ELSA-2011-0258)	Nessus	Oracle Linux Local Security Checks	medium
60955	Scientific Linux Security Update : subversion on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
53758	openSUSE Security Update : libsvn_auth_gnome_keyring-1-0 (openSUSE-SU-2010:1042-1)	Nessus	SuSE Local Security Checks	medium
53679	openSUSE Security Update : libsvn_auth_gnome_keyring-1-0 (openSUSE-SU-2010:1042-1)	Nessus	SuSE Local Security Checks	medium
52754	Mac OS X 10.6.x < 10.6.7 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
800796	Mac OS X 10.6 < 10.6.7 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	high
5826	Mac OS X 10.6 < 10.6.7 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
51995	RHEL 6 : subversion (RHSA-2011:0258)	Nessus	Red Hat Local Security Checks	medium
51846	Ubuntu 6.06 LTS / 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : subversion vulnerabilities (USN-1053-1)	Nessus	Ubuntu Local Security Checks	medium
50396	Fedora 14 : subversion-1.6.13-1.fc14 (2010-16148)	Nessus	Fedora Local Security Checks	medium
50395	Fedora 13 : subversion-1.6.13-1.fc13 (2010-16136)	Nessus	Fedora Local Security Checks	medium
50394	Fedora 12 : subversion-1.6.13-1.fc12.1 (2010-16115)	Nessus	Fedora Local Security Checks	medium
49967	Mandriva Linux Security Advisory : subversion (MDVSA-2010:199)	Nessus	Mandriva Local Security Checks	medium
49815	Debian DSA-2118-1 : subversion - logic flaw	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2010-3315

medium

Tenable Plugins

medium

medium

medium

medium

medium

high

high

critical

medium

medium

medium

medium

medium

medium

medium