The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.16, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request that contains a lock token.

Remote attackers could crash an svn server by causing a NULL deref (CVE-2011-0715).

- CVE-2011-1752: The mod_dav_svn Apache HTTPD server     module can be crashed though when asked to deliver     baselined WebDAV resources.

  - CVE-2011-1783: The mod_dav_svn Apache HTTPD server     module can trigger a loop which consumes all available     memory on the system.

  - CVE-2011-1921: The mod_dav_svn Apache HTTPD server     module may leak to remote users the file contents of     files configured to be unreadable by those users.

  - CVE-2011-0715: Remote attackers could crash an svn     server by causing a NULL deref

The remote host is affected by the vulnerability described in GLSA-201309-11 (Subversion: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Subversion. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could cause a Denial of Service condition or obtain       sensitive information. A local attacker could escalate his privileges to       the user running svnserve.
  Workaround :

    There is no known workaround at this time.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-0328 advisory.

    [1.6.11-2.3]
    - add security fix for CVE-2011-0715 (#681173)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-0327 advisory.

    [1.6.11-7.3]
    - add fix for svnadmin hotcopy (#681522)

    [1.6.11-7.2]
    - add security fix for CVE-2011-0715 (#681171)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A NULL pointer dereference flaw was found in the way the mod_dav_svn module processed certain requests to lock working copy paths in a repository. A remote attacker could issue a lock request that could cause the httpd process serving the request to crash. (CVE-2011-0715)

This update also fixes the following bug :

  - A regression was found in the handling of repositories     which do not have a 'db/fsfs.conf' file. The 'svnadmin     hotcopy' command would fail when trying to produce a     copy of such a repository. This command has been fixed     to ignore the absence of the 'fsfs.conf' file. The     'svnadmin hotcopy' command will now succeed for this     type of repository. (BZ#681522)

After installing the updated packages, you must restart the httpd daemon, if you are using mod_dav_svn, for the update to take effect.

Subversion was updated to fix several security issues :

  - The mod_dav_svn Apache HTTPD server module can be     crashed though when asked to deliver baselined WebDAV     resources. (CVE-2011-1752)

  - The mod_dav_svn Apache HTTPD server module can trigger a     loop which consumes all available memory on the system.
    (CVE-2011-1783)

  - Remote attackers could crash an svn server by causing a     NULL deref. (CVE-2011-0715)

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.8. This update contains security-related fixes for the following components :

  - App Store
  - ATS
  - Certificate Trust Policy
  - CoreFoundation
  - CoreGraphics
  - FTP Server
  - ImageIO
  - International Components for Unicode
  - Kernel
  - Libsystem
  - libxslt
  - MobileMe
  - MySQL
  - OpenSSL
  - patch
  - QuickLook
  - QuickTime
  - Samba
  - servermgrd
  - subversion

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2011-004 applied. This update contains security- related fixes for the following components :

  - AirPort
  - App Store
  - ColorSync
  - CoreGraphics
  - ImageIO
  - Libsystem
  - libxslt
  - MySQL
  - patch
  - Samba
  - servermgrd
  - subversion

Versions of Mac OS X 10.6 earlier than 10.6.8 are potentially affected by a security issue.  Mac OS X 10.6.8 contains a security fix for the following products :

  - App Store

  - ATS

  - Certificate Trust Policy

  - CoreFoundation

  - CoreGraphics

  - FTP Server

  - ImageIO

  - International Components for Unicode

  - Kernel

  - Libsystem

  - libxslt

  - MobileMe

  - MySQL

  - OpenSSL

  - patch

  - QuickLook

  - QuickTime

  - Samba

  - servermgrd

  - subversion
IAVA Reference : 2011-A-0160
IAVB Reference : 2012-B-0038
STIG Finding Severity : Category I

Versions of Mac OS X 10.6 earlier than 10.6.8 are potentially affected by a security issue.  Mac OS X 10.6.8 contains a security fix for the following products :

  - App Store

  - ATS

  - Certificate Trust Policy

  - CoreFoundation

  - CoreGraphics

  - FTP Server

  - ImageIO

  - International Components for Unicode

  - Kernel

  - Libsystem

  - libxslt

  - MobileMe

  - MySQL

  - OpenSSL

  - patch

  - QuickLook

  - QuickTime

  - Samba

  - servermgrd

  - subversion

Updated subversion packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. The mod_dav_svn module is used with the Apache HTTP Server to allow access to Subversion repositories via HTTP.

A NULL pointer dereference flaw was found in the way the mod_dav_svn module processed certain requests to lock working copy paths in a repository. A remote attacker could issue a lock request that could cause the httpd process serving the request to crash. (CVE-2011-0715)

Red Hat would like to thank Hyrum Wright of the Apache Subversion project for reporting this issue. Upstream acknowledges Philip Martin, WANdisco, Inc. as the original reporter.

This update also fixes the following bug :

* A regression was found in the handling of repositories which do not have a 'db/fsfs.conf' file. The 'svnadmin hotcopy' command would fail when trying to produce a copy of such a repository. This command has been fixed to ignore the absence of the 'fsfs.conf' file. The 'svnadmin hotcopy' command will now succeed for this type of repository. (BZ#681522)

All Subversion users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, you must restart the httpd daemon, if you are using mod_dav_svn, for the update to take effect.

A vulnerability was discovered and corrected in subversion :

The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.16, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request that contains a lock token (CVE-2011-0715).

Additionally for Corporate Server 4 and Enterprise Server 5 subversion have been upgraded to the 1.6.16 version due to of numerous upstream fixes and new features, the serf packages has also been upgraded to the now required 0.3.0 version.

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been upgraded to the 1.6.16 version which is not vulnerable to this issue.

Philip Martin discovered that the Subversion mod_dav_svn module for Apache did not properly handle certain requests containing a lock token. A remote attacker could use this flaw to cause the service to crash, leading to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A NULL pointer dereference flaw was found in the way the mod_dav_svn module processed certain requests to lock working copy paths in a repository. A remote attacker could issue a lock request that could cause the httpd process serving the request to crash. (CVE-2011-0715)

The Fedora Project would like to thank Hyrum Wright of the Apache Subversion project for reporting this issue. Upstream acknowledges Philip Martin, WANdisco, Inc. as the original reporter.

Several bugs are also fixed in this update :

  - more improvement to the 'blame -g' memory leak from     1.6.15

    - avoid unnecessary globbing for performance

    - don't add tree conflicts when one already exists

    - fix potential crash when requesting mergeinfo

    - don't attempt to resolve prop conflicts in 'merge
      --dry-run'

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A NULL pointer dereference flaw was found in the way the mod_dav_svn module processed certain requests to lock working copy paths in a repository. A remote attacker could issue a lock request that could cause the httpd process serving the request to crash. (CVE-2011-0715)

The Fedora Project would like to thank Hyrum Wright of the Apache Subversion project for reporting this issue. Upstream acknowledges Philip Martin, WANdisco, Inc. as the original reporter.

Several bugs are also fixed in this update :

  - more improvement to the 'blame -g' memory leak from     1.6.15

    - avoid unnecessary globbing for performance

    - don't add tree conflicts when one already exists

    - fix potential crash when requesting mergeinfo

    - don't attempt to resolve prop conflicts in 'merge
      --dry-run'

    - improve svnsync handling of dir copies

    - hide unreadable dirs in mod_dav_svn's GET response

    - make 'svnmucc propsetf' actually work

    - limit memory fragmentation in svnserve

    - fix 'svn export' regression from 1.6.13

    - fix 'svn export' mistakenly uri-encodes paths

    - fix server-side memory leaks triggered by 'blame -g'

    - prevent crash in mod_dav_svn when using SVNParentPath

    - allow 'log -g' to continue in the face of invalid       mergeinfo

    - filter unreadable paths for 'svn ls' and 'svn co'

    - fix abort in 'svn blame -g'

    - fix file handle leak in ruby bindings

    - remove check for 1.7-style working copies

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New subversion packages are available for Slackware 12.0, 12.1, 12.2, 13.0, 13.1, and -current to fix a security issue.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:0328 advisory.

  - subversion (mod_dav_svn): DoS (NULL ptr deref) by a lock token sent from a not authenticated Subversion     client (CVE-2011-0715)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:0327 advisory.

    Subversion (SVN) is a concurrent version control system which enables one     or more users to collaborate in developing and maintaining a hierarchy of     files and directories while keeping a history of all changes. The     mod_dav_svn module is used with the Apache HTTP Server to allow access to     Subversion repositories via HTTP.

    A NULL pointer dereference flaw was found in the way the mod_dav_svn module     processed certain requests to lock working copy paths in a repository. A     remote attacker could issue a lock request that could cause the httpd     process serving the request to crash. (CVE-2011-0715)

    Red Hat would like to thank Hyrum Wright of the Apache Subversion project     for reporting this issue. Upstream acknowledges Philip Martin, WANdisco,     Inc. as the original reporter.

    This update also fixes the following bug:

    * A regression was found in the handling of repositories which do not have     a db/fsfs.conf file. The svnadmin hotcopy command would fail when     trying to produce a copy of such a repository. This command has been fixed     to ignore the absence of the fsfs.conf file. The svnadmin hotcopy     command will now succeed for this type of repository. (BZ#681522)

    All Subversion users should upgrade to these updated packages, which     contain backported patches to correct these issues. After installing the     updated packages, you must restart the httpd daemon, if you are using     mod_dav_svn, for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Subversion project reports :

Subversion HTTP servers up to 1.5.9 (inclusive) or 1.6.15 (inclusive) are vulnerable to a remotely triggerable NULL pointer dereference.

Philip Martin discovered that HTTP-based Subversion servers crash when processing lock requests on repositories which support unauthenticated read access.

ID	Name	Product	Family	Severity
75922	openSUSE Security Update : libsvn_auth_gnome_keyring-1-0 (openSUSE-SU-2011:0238-1)	Nessus	SuSE Local Security Checks	medium
75617	openSUSE Security Update : libsvn_auth_gnome_keyring-1-0 (openSUSE-SU-2011:0693-1)	Nessus	SuSE Local Security Checks	medium
70084	GLSA-201309-11 : Subversion: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
68221	Oracle Linux 6 : subversion (ELSA-2011-0328)	Nessus	Oracle Linux Local Security Checks	high
68220	Oracle Linux 5 : subversion (ELSA-2011-0327)	Nessus	Oracle Linux Local Security Checks	high
60982	Scientific Linux Security Update : subversion on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
57173	SuSE 10 Security Update : subversion (ZYPP Patch Number 7560)	Nessus	SuSE Local Security Checks	medium
55416	Mac OS X 10.6.x < 10.6.8 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
55415	Mac OS X Multiple Vulnerabilities (Security Update 2011-004)	Nessus	MacOS X Local Security Checks	high
800790	Mac OS X 10.6 < 10.6.8 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	high
5968	Mac OS X 10.6 < 10.6.8 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
53425	CentOS 5 : subversion (CESA-2011:0327)	Nessus	CentOS Local Security Checks	medium
53309	Mandriva Linux Security Advisory : subversion (MDVSA-2011:067)	Nessus	Mandriva Local Security Checks	medium
53220	Ubuntu 6.06 LTS / 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : subversion vulnerability (USN-1096-1)	Nessus	Ubuntu Local Security Checks	medium
52985	Fedora 15 : subversion-1.6.16-1.fc15 (2011-3775)	Nessus	Fedora Local Security Checks	medium
52693	Fedora 13 : subversion-1.6.16-1.fc13 (2011-2698)	Nessus	Fedora Local Security Checks	medium
52692	Fedora 14 : subversion-1.6.16-1.fc14 (2011-2657)	Nessus	Fedora Local Security Checks	medium
52635	Slackware 12.0 / 12.1 / 12.2 / 13.0 / 13.1 / current : subversion (SSA:2011-070-01)	Nessus	Slackware Local Security Checks	medium
52595	RHEL 6 : subversion (RHSA-2011:0328)	Nessus	Red Hat Local Security Checks	high
52594	RHEL 5 : subversion (RHSA-2011:0327)	Nessus	Red Hat Local Security Checks	high
52563	FreeBSD : subversion -- remote HTTP DoS vulnerability (e27ca763-4721-11e0-bdc4-001e8c75030d)	Nessus	FreeBSD Local Security Checks	medium
52548	Debian DSA-2181-1 : subversion - denial of service	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2011-0715

high

Tenable Plugins

medium

medium

high

high

high

medium

medium

critical

high

high

critical

medium

medium

medium

medium

medium

medium

medium

high

high

medium

medium