Multiple memory leaks in rev_hunt.c in Apache Subversion before 1.6.15 allow remote authenticated users to cause a denial of service (memory consumption and daemon crash) via the -g option to the blame command.

The subversion server could be crashed by clients inside SVNParentPath(). Additionally an Out Of Memory condition via 'blame
-g' has been fixed. CVE-2010-4539 and CVE-2010-4644 have been assigned to these issues.

The remote host is affected by the vulnerability described in GLSA-201309-11 (Subversion: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Subversion. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could cause a Denial of Service condition or obtain       sensitive information. A local attacker could escalate his privileges to       the user running svnserve.
  Workaround :

    There is no known workaround at this time.

From Red Hat Security Advisory 2011:0258 :

Updated subversion packages that fix three security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. The mod_dav_svn module is used with the Apache HTTP Server to allow access to Subversion repositories via HTTP.

An access restriction bypass flaw was found in the mod_dav_svn module.
If the SVNPathAuthz directive was set to 'short_circuit', certain access rules were not enforced, possibly allowing sensitive repository data to be leaked to remote users. Note that SVNPathAuthz is set to 'On' by default. (CVE-2010-3315)

A server-side memory leak was found in the Subversion server. If a malicious, remote user performed 'svn blame' or 'svn log' operations on certain repository files, it could cause the Subversion server to consume a large amount of system memory. (CVE-2010-4644)

A NULL pointer dereference flaw was found in the way the mod_dav_svn module processed certain requests. If a malicious, remote user issued a certain type of request to display a collection of Subversion repositories on a host that has the SVNListParentPath directive enabled, it could cause the httpd process serving the request to crash. Note that SVNListParentPath is not enabled by default.
(CVE-2010-4539)

All Subversion users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the Subversion server must be restarted for the update to take effect: restart httpd if you are using mod_dav_svn, or restart svnserve if it is used.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0257 advisory.

    [1.6.11-7.1]
    - add security fixes for CVE-2010-4644, CVE-2010-4539 (#672676)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An access restriction bypass flaw was found in the mod_dav_svn module.
If the SVNPathAuthz directive was set to 'short_circuit', certain access rules were not enforced, possibly allowing sensitive repository data to be leaked to remote users. Note that SVNPathAuthz is set to 'On' by default. (CVE-2010-3315)

A server-side memory leak was found in the Subversion server. If a malicious, remote user performed 'svn blame' or 'svn log' operations on certain repository files, it could cause the Subversion server to consume a large amount of system memory. (CVE-2010-4644)

A NULL pointer dereference flaw was found in the way the mod_dav_svn module processed certain requests. If a malicious, remote user issued a certain type of request to display a collection of Subversion repositories on a host that has the SVNListParentPath directive enabled, it could cause the httpd process serving the request to crash. Note that SVNListParentPath is not enabled by default.
(CVE-2010-4539)

After installing the updated packages, the Subversion server must be restarted for the update to take effect: restart httpd if you are using mod_dav_svn, or restart svnserve if it is used.

A server-side memory leak was found in the Subversion server. If a malicious, remote user performed 'svn blame' or 'svn log' operations on certain repository files, it could cause the Subversion server to consume a large amount of system memory. (CVE-2010-4644)

A NULL pointer dereference flaw was found in the way the mod_dav_svn module (for use with the Apache HTTP Server) processed certain requests. If a malicious, remote user issued a certain type of request to display a collection of Subversion repositories on a host that has the SVNListParentPath directive enabled, it could cause the httpd process serving the request to crash. Note that SVNListParentPath is not enabled by default. (CVE-2010-4539)

After installing the updated packages, the Subversion server must be restarted for the update to take effect: restart httpd if you are using mod_dav_svn, or restart svnserve if it is used.

Updated subversion packages that fix two security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes.

A server-side memory leak was found in the Subversion server. If a malicious, remote user performed 'svn blame' or 'svn log' operations on certain repository files, it could cause the Subversion server to consume a large amount of system memory. (CVE-2010-4644)

A NULL pointer dereference flaw was found in the way the mod_dav_svn module (for use with the Apache HTTP Server) processed certain requests. If a malicious, remote user issued a certain type of request to display a collection of Subversion repositories on a host that has the SVNListParentPath directive enabled, it could cause the httpd process serving the request to crash. Note that SVNListParentPath is not enabled by default. (CVE-2010-4539)

All Subversion users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the Subversion server must be restarted for the update to take effect: restart httpd if you are using mod_dav_svn, or restart svnserve if it is used.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0258 advisory.

  - Subversion: Access restriction bypass by checkout of the root of the repository (CVE-2010-3315)

  - Subversion (mod_dav_svn): DoS (crash) by processing certain requests to display all available repositories     to a web browser (CVE-2010-4539)

  - Subversion: DoS (memory consumption) by processing blame or log -g requests on certain files     (CVE-2010-4644)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0257 advisory.

    Subversion (SVN) is a concurrent version control system which enables one     or more users to collaborate in developing and maintaining a hierarchy of     files and directories while keeping a history of all changes.

    A server-side memory leak was found in the Subversion server. If a     malicious, remote user performed svn blame or svn log operations on     certain repository files, it could cause the Subversion server to consume     a large amount of system memory. (CVE-2010-4644)

    A NULL pointer dereference flaw was found in the way the mod_dav_svn module     (for use with the Apache HTTP Server) processed certain requests. If a     malicious, remote user issued a certain type of request to display a     collection of Subversion repositories on a host that has the     SVNListParentPath directive enabled, it could cause the httpd process     serving the request to crash. Note that SVNListParentPath is not enabled by     default. (CVE-2010-4539)

    All Subversion users should upgrade to these updated packages, which     contain backported patches to correct these issues. After installing the     updated packages, the Subversion server must be restarted for the update     to take effect: restart httpd if you are using mod_dav_svn, or restart     svnserve if it is used.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that Subversion incorrectly handled certain 'partial access' privileges in rare scenarios. Remote authenticated users could use this flaw to obtain sensitive information (revision properties).
This issue only applied to Ubuntu 6.06 LTS. (CVE-2007-2448)

It was discovered that the Subversion mod_dav_svn module for Apache did not properly handle a named repository as a rule scope. Remote authenticated users could use this flaw to bypass intended restrictions. This issue only applied to Ubuntu 9.10, 10.04 LTS, and 10.10. (CVE-2010-3315)

It was discovered that the Subversion mod_dav_svn module for Apache incorrectly handled the walk function. Remote authenticated users could use this flaw to cause the service to crash, leading to a denial of service. (CVE-2010-4539)

It was discovered that Subversion incorrectly handled certain memory operations. Remote authenticated users could use this flaw to consume large quantities of memory and cause the service to crash, leading to a denial of service. This issue only applied to Ubuntu 9.10, 10.04 LTS, and 10.10. (CVE-2010-4644).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been found and corrected in subversion :

The walk function in repos.c in the mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.15, allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger the walking of SVNParentPath collections (CVE-2010-4539).

Multiple memory leaks in rev_hunt.c in Apache Subversion before 1.6.15 allow remote authenticated users to cause a denial of service (memory consumption and daemon crash) via the -g option to the blame command (CVE-2010-4644).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been upgraded to the latest versions (1.5.9, 1.6.15) which is not affected by these issues and in turn contains many bugfixes as well.

This release includes the latest Subversion release, fixing several bugs :

  - improve svnsync handling of dir copies

    - hide unreadable dirs in mod_dav_svn's GET response

    - make 'svnmucc propsetf' actually work

    - limit memory fragmentation in svnserve

    - fix 'svn export' regression from 1.6.13

    - fix 'svn export' mistakenly uri-encodes paths

    - fix server-side memory leaks triggered by 'blame -g'

    - prevent crash in mod_dav_svn when using SVNParentPath

    - allow 'log -g' to continue in the face of invalid       mergeinfo

    - filter unreadable paths for 'svn ls' and 'svn co'

    - fix abort in 'svn blame -g'

    - fix file handle leak in ruby bindings

    - remove check for 1.7-style working copies

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Entry for CVE-2010-4539 says :

The walk function in repos.c in the mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.15, allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger the walking of SVNParentPath collections.

Entry for CVE-2010-4644 says :

Multiple memory leaks in rev_hunt.c in Apache Subversion before 1.6.15 allow remote authenticated users to cause a denial of service (memory consumption and daemon crash) via the -g option to the blame command.

ID	Name	Product	Family	Severity
75616	openSUSE Security Update : libsvn_auth_gnome_keyring-1-0 (openSUSE-SU-2011:0136-1)	Nessus	SuSE Local Security Checks	medium
70084	GLSA-201309-11 : Subversion: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
68200	Oracle Linux 6 : subversion (ELSA-2011-0258)	Nessus	Oracle Linux Local Security Checks	medium
68199	Oracle Linux 5 : subversion (ELSA-2011-0257)	Nessus	Oracle Linux Local Security Checks	medium
60955	Scientific Linux Security Update : subversion on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
60954	Scientific Linux Security Update : subversion on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
53759	openSUSE Security Update : libsvn_auth_gnome_keyring-1-0 (openSUSE-SU-2011:0136-1)	Nessus	SuSE Local Security Checks	medium
53420	CentOS 5 : subversion (CESA-2011:0257)	Nessus	CentOS Local Security Checks	medium
51995	RHEL 6 : subversion (RHSA-2011:0258)	Nessus	Red Hat Local Security Checks	medium
51994	RHEL 5 : subversion (RHSA-2011:0257)	Nessus	Red Hat Local Security Checks	medium
51846	Ubuntu 6.06 LTS / 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : subversion vulnerabilities (USN-1053-1)	Nessus	Ubuntu Local Security Checks	medium
51798	Mandriva Linux Security Advisory : subversion (MDVSA-2011:006)	Nessus	Mandriva Local Security Checks	medium
51565	Fedora 14 : subversion-1.6.15-1.fc14 (2011-0099)	Nessus	Fedora Local Security Checks	medium
51520	FreeBSD : subversion -- multiple DoS (71612099-1e93-11e0-a587-001b77d09812)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2010-4644

medium

Tenable Plugins

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium