The get_resource function in repos.c in the mod_dav_svn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service (crash) via vectors related to the server root and request methods other than GET, as demonstrated by the "svn ls http://svn.example.com" command.

The remote host is affected by the vulnerability described in GLSA-201610-05 (Subversion, Serf: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Subversion and Serf.
      Please review the CVE identifiers referenced below for details   Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, conduct a man-in-the-middle attack, obtain       sensitive information, or cause a Denial of Service Condition.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities were discovered in Subversion, a version control system. The Common Vulnerabilities and Exposures project identifies the following problems :

CVE-2015-0248

Subversion mod_dav_svn and svnserve were vulnerable to a remotely triggerable assertion DoS vulnerability for certain requests with dynamically evaluated revision numbers.

CVE-2015-0251

Subversion HTTP servers allow spoofing svn:author property values for new revisions via specially crafted v1 HTTP protocol request sequences.

CVE-2013-1845

Subversion mod_dav_svn was vulnerable to a denial of service attack through a remotely triggered memory exhaustion.

CVE-2013-1846 / CVE-2013-1847 / CVE-2013-1849 / CVE-2014-0032

Subversion mod_dav_svn was vulnerable to multiple remotely triggered crashes.

This update has been prepared by James McCoy.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated subversion packages fix security vulnerabilities :

The mod_dav_svn module in Apache Subversion before 1.8.8, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service (crash) via an OPTIONS request (CVE-2014-0032).

Ben Reser discovered that Subversion did not correctly validate SSL certificates containing wildcards. A remote attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications (CVE-2014-3522).

Bert Huijben discovered that Subversion did not properly handle cached credentials. A malicious server could possibly use this issue to obtain credentials cached for a different server (CVE-2014-3528).

A NULL pointer dereference flaw was found in the way mod_dav_svn handled REPORT requests. A remote, unauthenticated attacker could use a crafted REPORT request to crash mod_dav_svn (CVE-2014-3580).

A NULL pointer dereference flaw was found in the way mod_dav_svn handled URIs for virtual transaction names. A remote, unauthenticated attacker could send a request for a virtual transaction name that does not exist, causing mod_dav_svn to crash (CVE-2014-8108).

The remote Mac OS X host has a version of Apple Xcode prior to 6.0.1 installed. It is, therefore, affected by a denial of service vulnerability in the bundled Subversion component. The 'get_resource' function in 'repos.c' in the 'mod_dav_svn' module allows remote attackers to cause a denial of service when the 'SVNListParentPath' option is enabled.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2316-1 advisory.

    Lieven Govaerts discovered that the Subversion mod_dav_svn module incorrectly handled certain request     methods when SVNListParentPath was enabled. A remote attacker could use this issue to cause the server to     crash, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS. (CVE-2014-0032)

    Ben Reser discovered that Subversion did not correctly validate SSL certificates containing wildcards. A     remote attacker could exploit this to perform a machine-in-the-middle attack to view sensitive information     or alter encrypted communications. (CVE-2014-3522)

    Bert Huijben discovered that Subversion did not properly handle cached credentials. A malicious server     could possibly use this issue to obtain credentials cached for a different server. (CVE-2014-3528)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Apache Subversion was updated to 1.7.16 [bnc#862459] This release addresses one security issue: CVE-2014-0032: mod_dav_svn DoS vulnerability with SVNListParentPath. Affects servers with mod_dav_svn when configured on the root path of the server and SVNListParentPath is on.

  - Client-side bugfixes :

  - copy: fix some scenarios that broke the working copy

  - diff: fix regressions due to fixes in 1.7.14

  - Server-side bugfixes :

  - mod_dav_svn: prevent crashes with SVNListParentPath on     (CVE-2014-0032)

  - reduce memory usage during checkout and export     Developer-visible changes :

  - fix failure in checkout_tests.py

  - support compiling against Cyrus sasl 2.1.25

  - support compiling against neon 0.30.x

  - modified patches :

  - subversion-no-build-date.patch for context changes

  - 1.7.15 was not released

  - only require and build with junit when building with     java and running regression tests

Apache Subversion was updated to version 1.8.8 :

It fix a remotely triggerable segfault in mod_dav_svn when svn is handling the server root and SVNListParentPath is on [bnc#862459] CVE-2014-0032

  - Client-side bugfixes :

  - fix automatic relocate for wcs not at repository root

  - wc: improve performance when used with SQLite 3.8

  - copy: fix some scenarios that broke the working copy

  - move: fix errors when moving files between an external     and the parent working copy

  - log: resolve performance regression in certain scenarios

  - merge: decrease work to detect differences between 3     files

  - commit: don't change file permissions inappropriately

  - commit: fix assertion due to invalid pool lifetime

  - version: don't cut off the distribution version on Linux

  - flush stdout before exiting to avoid information being     lost

  - status: fix missing sentinel value on warning codes

  - update/switch: improve some WC db queries that may     return incorrect results depending on how SQLite is     built

  - Server-side bugfixes :

  - reduce memory usage during checkout and export

  - fsfs: create rep-cache.db with proper permissions

  - mod_dav_svn: prevent crashes with SVNListParentPath on     [bnc#862459] CVE-2014-0032

  - mod_dav_svn: fix SVNAllowBulkUpdates directive merging

  - mod_dav_svn: include requested property changes in     reports

  - svnserve: correct default cache size in help text

  - svnadmin dump: reduce size of dump files with '--deltas'

  - resolve integer underflow that resulted in infinite     loops

  - developer visible changes :

  - fix ocassional failure of check_tests.py 12

  - fix failure with SQLite 3.8.1-3.8.3 when built with     SQLITE_ENABLE_STAT3/4 due to bug in SQLite

  - specify SQLite defaults that can be changed when SQLite     is built to avoid unexpected behavior with Subversion

  - numerous documentation fixes

  - svn_client_commit_item3_dup() fix pool lifetime issues

  - ra_serf: properly ask multiple certificate validation     providers for acceptance of certificate failures

  - release internal fs objects when closing commit editor

  - svn_client_proplist4() don't call the callback multiple     times for the same path in order to deliver inherited     properties

  - Bindings :

  - swig-pl: fix with --enable-sqlite-compatibility-version

  - swig: fix building from tarball with an out-of-tree     build

  - removed patches :

  - subversion-1.8.x-fix-ppc-tests.patch, committed upstream

  - packaging changes :

  - only require and build with junit when building with     java and running regression tests

  - 1.8.6 and 1.8.7 were not released

A flaw was found in the way the mod_dav_svn module handled OPTIONS requests. A remote attacker with read access to an SVN repository served via HTTP could use this flaw to cause the httpd process that handled such a request to crash.

The get_resource function in repos.c in the mod_dav_svn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service (crash) via vectors related to the server root and request methods other than GET, as demonstrated by the 'svn ls http://svn.example.com' command.

This update includes the latest stable release of Apache Subversion 1.7, fixing a security issue (CVE-2014-0032) :

Subversion's mod_dav_svn Apache HTTPD server module will crash when it receives an OPTIONS request against the server root and Subversion is configured to handle the server root and SVNListParentPath is on.

This can lead to a DoS. There are no known instances of this problem being exploited in the wild, but the details of how to exploit it have been disclosed on the Subversion development mailing list.

For more information, see :

https://subversion.apache.org/security/CVE-2014-0032-advisory.txt

A number of client-side bug fixes are included in this update :

  - copy: fix some scenarios that broke the working copy

    - diff: fix regressions due to fixes in 1.7.14

One server-side bug fixes is also included :

  - reduce memory usage during checkout and export

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update includes the latest stable release of Subversion, fixing a security issue (CVE-2014-0032) :

Subversion's mod_dav_svn Apache HTTPD server module will crash when it receives an OPTIONS request against the server root and Subversion is configured to handle the server root and SVNListParentPath is on.

This can lead to a DoS. There are no known instances of this problem being exploited in the wild, but the details of how to exploit it have been disclosed on the Subversion development mailing list.

For more information, see :

https://subversion.apache.org/security/CVE-2014-0032-advisory.txt

A number of client-side bug fixes are included in this update :

  - fix automatic relocate for wcs not at repository root

    - wc: improve performance when used with SQLite 3.8

    - copy: fix some scenarios that broke the working copy

    - move: fix errors when moving files between an external       and the parent working copy

    - log: resolve performance regression in certain       scenarios

    - merge: decrease work to detect differences between 3       files

    - commit: don't change file permissions inappropriately

    - commit: fix assertion due to invalid pool lifetime

    - version: don't cut off the distribution version on       Linux

    - flush stdout before exiting to avoid information being       lost

    - status: fix missing sentinel value on warning codes

    - update/switch: improve some WC db queries that may       return incorrect results depending on how SQLite is       built

Server-side bugfixes :

  - reduce memory usage during checkout and export

    - fsfs: create rep-cache.db with proper permissions

    - mod_dav_svn: prevent crashes with SVNListParentPath on       (CVE-2014-0032)

    - mod_dav_svn: fix SVNAllowBulkUpdates directive merging

    - mod_dav_svn: include requested property changes in       reports

    - svnserve: correct default cache size in help text

    - svnadmin dump: reduce size of dump files with       '--deltas'

    - resolve integer underflow that resulted in infinite       loops

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been discovered and corrected in subversion :

The get_resource function in repos.c in the mod_dav_svn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service (crash) via vectors related to the server root and request methods other than GET, as demonstrated by the svn ls http://svn.example.com command (CVE-2014-0032).

This advisory provides the latest version of subversion (1.7.16) which is not vulnerable to this issue.

Updated subversion packages that fix three security issues are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. The mod_dav_svn module is used with the Apache HTTP Server to allow access to Subversion repositories via HTTP.

A flaw was found in the way the mod_dav_svn module handled OPTIONS requests. A remote attacker with read access to an SVN repository served via HTTP could use this flaw to cause the httpd process that handled such a request to crash. (CVE-2014-0032)

A flaw was found in the way Subversion handled file names with newline characters when the FSFS repository format was used. An attacker with commit access to an SVN repository could corrupt a revision by committing a specially crafted file. (CVE-2013-1968)

A flaw was found in the way the svnserve tool of Subversion handled remote client network connections. An attacker with read access to an SVN repository served via svnserve could use this flaw to cause the svnserve daemon to exit, leading to a denial of service.
(CVE-2013-2112)

All subversion users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, for the update to take effect, you must restart the httpd daemon, if you are using mod_dav_svn, and the svnserve daemon, if you are serving Subversion repositories via the svn:// protocol.

A flaw was found in the way the mod_dav_svn module handled OPTIONS requests. A remote attacker with read access to an SVN repository served via HTTP could use this flaw to cause the httpd process that handled such a request to crash. (CVE-2014-0032)

A flaw was found in the way Subversion handled file names with newline characters when the FSFS repository format was used. An attacker with commit access to an SVN repository could corrupt a revision by committing a specially crafted file. (CVE-2013-1968)

A flaw was found in the way the svnserve tool of Subversion handled remote client network connections. An attacker with read access to an SVN repository served via svnserve could use this flaw to cause the svnserve daemon to exit, leading to a denial of service.
(CVE-2013-2112)

After installing the updated packages, for the update to take effect, you must restart the httpd daemon, if you are using mod_dav_svn, and the svnserve daemon, if you are serving Subversion repositories via the svn:// protocol.

From Red Hat Security Advisory 2014:0255 :

Updated subversion packages that fix three security issues are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. The mod_dav_svn module is used with the Apache HTTP Server to allow access to Subversion repositories via HTTP.

A flaw was found in the way the mod_dav_svn module handled OPTIONS requests. A remote attacker with read access to an SVN repository served via HTTP could use this flaw to cause the httpd process that handled such a request to crash. (CVE-2014-0032)

A flaw was found in the way Subversion handled file names with newline characters when the FSFS repository format was used. An attacker with commit access to an SVN repository could corrupt a revision by committing a specially crafted file. (CVE-2013-1968)

A flaw was found in the way the svnserve tool of Subversion handled remote client network connections. An attacker with read access to an SVN repository served via svnserve could use this flaw to cause the svnserve daemon to exit, leading to a denial of service.
(CVE-2013-2112)

All subversion users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, for the update to take effect, you must restart the httpd daemon, if you are using mod_dav_svn, and the svnserve daemon, if you are serving Subversion repositories via the svn:// protocol.

The installed version of Subversion Server is affected by an error related to 'mod_dav_svn', the 'SVNListParentPath' configuration option, and handling 'OPTIONS' requests that could allow denial of service attacks.

New subversion packages are available for Slackware 14.0, 14.1, and
-current to fix denial-of-service issues.

ID	Name	Product	Family	Severity
93992	GLSA-201610-05 : Subversion, Serf: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
83060	Debian DLA-207-1 : subversion security update	Nessus	Debian Local Security Checks	medium
82338	Mandriva Linux Security Advisory : subversion (MDVSA-2015:085)	Nessus	Mandriva Local Security Checks	medium
77863	Apple Xcode < 6.0.1 (Mac OS X)	Nessus	MacOS X Local Security Checks	medium
77219	Ubuntu 14.04 LTS : Subversion vulnerabilities (USN-2316-1)	Nessus	Ubuntu Local Security Checks	medium
75279	openSUSE Security Update : subversion (openSUSE-SU-2014:0334-1)	Nessus	SuSE Local Security Checks	medium
75270	openSUSE Security Update : subversion (openSUSE-SU-2014:0307-1)	Nessus	SuSE Local Security Checks	medium
73237	Amazon Linux AMI : subversion (ALAS-2014-318)	Nessus	Amazon Linux Local Security Checks	medium
73041	Fedora 19 : subversion-1.7.16-1.fc19 (2014-3567)	Nessus	Fedora Local Security Checks	medium
73033	Fedora 20 : subversion-1.8.8-1.fc20 (2014-3365)	Nessus	Fedora Local Security Checks	medium
72920	Mandriva Linux Security Advisory : subversion (MDVSA-2014:049)	Nessus	Mandriva Local Security Checks	medium
72866	CentOS 5 / 6 : subversion (CESA-2014:0255)	Nessus	CentOS Local Security Checks	high
72855	Scientific Linux Security Update : subversion on SL5.x, SL6.x i386/x86_64 (20140305)	Nessus	Scientific Linux Local Security Checks	high
72854	RHEL 5 / 6 : subversion (RHSA-2014:0255)	Nessus	Red Hat Local Security Checks	high
72852	Oracle Linux 5 / 6 : subversion (ELSA-2014-0255)	Nessus	Oracle Linux Local Security Checks	high
72744	Apache Subversion 1.3.x - 1.7.14 / 1.8.x < 1.8.8 'mod_dav_svn' DoS	Nessus	Windows	medium
72731	Slackware 14.0 / 14.1 / current : subversion (SSA:2014-058-01)	Nessus	Slackware Local Security Checks	medium

Detections

Analytics

CVE-2014-0032

high

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

high

high

high

medium

medium