contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows remote authenticated users with commit permissions to execute arbitrary commands via shell metacharacters in a filename.

This update of subversion includes several bug and security fixes.

  - update to 1.7.10 [bnc#821505] CVE-2013-1968     CVE-2013-2088 CVE-2013-2112

  - Client-side bugfixes :

  - fix 'svn revert' 'no such table: revert_list' spurious     error

  - fix 'svn diff' doesn't show some locally added files

  - fix changelist filtering when --changelist values aren't     UTF8

  - fix 'svn diff --git' shows wrong copyfrom

  - fix 'svn diff -x-w' shows wrong changes

  - fix 'svn blame' sometimes shows every line as modified

  - fix regression in 'svn status -u' output for externals

  - fix file permissions change on commit of file with     keywords

  - improve some fatal error messages

  - fix externals not removed when working copy is made     shallow

  - Server-side bugfixes :

  - fix repository corruption due to newline in filename

  - fix svnserve exiting when a client connection is aborted

  - fix svnserve memory use after clear

  - fix repository corruption on power/disk failure on     Windows

  - Developer visible changes :

  - make get-deps.sh compatible with Solaris /bin/sh

  - fix infinite recursion bug in get-deps.sh

  - fix uninitialised output parameter of     svn_fs_commit_txn()

  - Bindings :

  - fix JavaHL thread-safety bug

The installed version of Subversion Server is affected by the following vulnerabilities :

  - An input validation error exists in two files in the     'contrib/' directory that could allow arbitrary code     execution. Note that this issue does not affect version     1.8.0. (CVE-2013-2088)

  - An error exists related to the 'mod_dav_svn' Apache     module that could allow denial of service attacks. Note     that this issue does not affect the 1.6.x branch.
    (CVE-2013-4131)

The remote host is affected by the vulnerability described in GLSA-201309-11 (Subversion: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Subversion. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could cause a Denial of Service condition or obtain       sensitive information. A local attacker could escalate his privileges to       the user running svnserve.
  Workaround :

    There is no known workaround at this time.

This update includes the latest release of Apache Subversion 1.7, version 1.7.11. Several security vulnerabilities are fixed in this update :

Subversion's mod_dav_svn Apache HTTPD server module will trigger an assertion on some requests made against a revision root. This can lead to a DoS. If assertions are disabled it will trigger a read overflow which may cause a segmentation fault or undefined behavior. Commit access is required to exploit this. (CVE-2013-4131)

If a filename which contains a newline character (ASCII 0x0a) is committed to a repository using the FSFS format, the resulting revision is corrupt. This can lead to disruption for users of the repository. (CVE-2013-1968)

Subversion's contrib/ directory contains two example hook scripts, which use 'svnlook changed' to examine a revision or transaction and then pass those paths as arguments to further 'svnlook' commands, without properly escaping the command-line. (CVE-2013-2088)

Subversion's svnserve server process may exit when an incoming TCP connection is closed early in the connection process. This can lead to disruption for users of the server. (CVE-2013-2112)

The following client-side bugs were fixed in the 1.7.10 release :

  - fix 'svn revert' 'no such table: revert_list' spurious     error

    - fix 'svn diff' doesn't show some locally added files

    - fix changelist filtering when --changelist values       aren't UTF8

    - fix 'svn diff --git' shows wrong copyfrom

    - fix 'svn diff -x-w' shows wrong changes

    - fix 'svn blame' sometimes shows every line as modified

    - fix regression in 'svn status -u' output for externals

    - fix file permissions change on commit of file with       keywords

    - improve some fatal error messages

    - fix externals not removed when working copy is made       shallow

The following server-side bugs are fixed :

  - fix repository corruption due to newline in filename

    - fix svnserve exiting when a client connection is       aborted

    - fix svnserve memory use after clear

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The installed version of SVN is affected by the following vulnerabilities:

  - Remote denial-of-service vulnerabilities exist due to an error in the svnserve server, as it does not properly handle aborted connection messages. (CVE-2013-1968, CVE-2013-2112)

  - A command-injection vulnerability exists in the 'svn-keyword-check.pl' hook script while processing filenames. (CVE-2013-2088)

Versions of Apache Subversion prior to 1.6.23, or 1.7.x prior to 1.7.10 are affected by the following vulnerabilities :

 - Remote denial-of-service vulnerabilities exist due to an error in the 'svnserve' server, as it does not properly handle aborted connection messages. (CVE-2013-1968, CVE-2013-2112)
 - A command injection vulnerability exists in the 'svn-keyword-check.pl' hook script while processing filenames. (CVE-2013-2088)

Subversion team reports :

The script contrib/hook-scripts/check-mime-type.pl does not escape argv arguments to 'svnlook' that start with a hyphen. This could be used to cause 'svnlook', and hence check-mime-type.pl, to error out.

The script contrib/hook-scripts/svn-keyword-check.pl parses filenames from the output of 'svnlook changed' and passes them to a further shell command (equivalent to the 'system()' call of the C standard library) without escaping them. This could be used to run arbitrary shell commands in the context of the user whom the pre-commit script runs as (the user who owns the repository).

ID	Name	Product	Family	Severity
75035	openSUSE Security Update : subversion (openSUSE-SU-2013:1006-1)	Nessus	SuSE Local Security Checks	high
71566	Apache Subversion 1.6.x / 1.7.x / 1.8.x < 1.6.23 / 1.7.11 / 1.8.1 Multiple Vulnerabilities	Nessus	Windows	high
70084	GLSA-201309-11 : Subversion: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
69355	Fedora 18 : subversion-1.7.11-1.fc18.1 (2013-13672)	Nessus	Fedora Local Security Checks	high
800980	Apache Subversion < 1.8.0 / 1.7.10 / 1.6.23 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	medium
6854	Apache Subversion < 1.6.23 / 1.7.x < 1.7.10 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
66736	FreeBSD : devel/subversion -- contrib hook-scripts can allow arbitrary code execution (6d0bf320-ca39-11e2-9673-001e8c75030d)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2013-2088

high

Tenable Plugins

high

high

high

high

medium

high

high