Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - subversion: Command injection through clients via malicious svn+ssh URLs (CVE-2017-9800)

  - Svnserve in Apache Subversion 1.4.0 through 1.7.12 and 1.8.0 through 1.8.1 allows local users to overwrite     arbitrary files or kill arbitrary processes via a symlink attack on the file specified by the --pid-file     option. (CVE-2013-4277)

  - Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL     and authentication realm to store cached credentials, which makes it easier for remote servers to obtain     the credentials via a crafted authentication realm. (CVE-2014-3528)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote host is affected by the vulnerability described in GLSA-201610-05 (Subversion, Serf: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Subversion and Serf.
      Please review the CVE identifiers referenced below for details   Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, conduct a man-in-the-middle attack, obtain       sensitive information, or cause a Denial of Service Condition.
  Workaround :

    There is no known workaround at this time.

Updated subversion packages fix security vulnerabilities :

The mod_dav_svn module in Apache Subversion before 1.8.8, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service (crash) via an OPTIONS request (CVE-2014-0032).

Ben Reser discovered that Subversion did not correctly validate SSL certificates containing wildcards. A remote attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications (CVE-2014-3522).

Bert Huijben discovered that Subversion did not properly handle cached credentials. A malicious server could possibly use this issue to obtain credentials cached for a different server (CVE-2014-3528).

A NULL pointer dereference flaw was found in the way mod_dav_svn handled REPORT requests. A remote, unauthenticated attacker could use a crafted REPORT request to crash mod_dav_svn (CVE-2014-3580).

A NULL pointer dereference flaw was found in the way mod_dav_svn handled URIs for virtual transaction names. A remote, unauthenticated attacker could send a request for a virtual transaction name that does not exist, causing mod_dav_svn to crash (CVE-2014-8108).

The Apple Xcode installed on the remote Mac OS X host is prior to version 6.2. It is, therefore, affected by the following vulnerabilities :

  - Numerous errors exist related to the bundled version of Apache Subversion. (CVE-2014-3522, CVE-2014-3528,     CVE-2014-3580, CVE-2014-8108)

  - An error exists related to the bundled version of Git that allows arbitrary files to be added to the .git     folder. (CVE-2014-9390)

A NULL pointer dereference flaw was found in the way the mod_dav_svn module handled REPORT requests. A remote, unauthenticated attacker could use a specially crafted REPORT request to crash mod_dav_svn.
(CVE-2014-3580)

A NULL pointer dereference flaw was found in the way the mod_dav_svn module handled certain requests for URIs that trigger a lookup of a virtual transaction name. A remote, unauthenticated attacker could send a request for a virtual transaction name that does not exist, causing mod_dav_svn to crash. (CVE-2014-8108)

It was discovered that Subversion clients retrieved cached authentication credentials using the MD5 hash of the server realm string without also checking the server's URL. A malicious server able to provide a realm that triggers an MD5 collision could possibly use this flaw to obtain the credentials for a different realm.
(CVE-2014-3528)

After installing the updated packages, for the update to take effect, you must restart the httpd daemon, if you are using mod_dav_svn, and the svnserve daemon, if you are serving Subversion repositories via the svn:// protocol.

A NULL pointer dereference flaw was found in the way the mod_dav_svn module handled REPORT requests. A remote, unauthenticated attacker could use a specially crafted REPORT request to crash mod_dav_svn.
(CVE-2014-3580)

It was discovered that Subversion clients retrieved cached authentication credentials using the MD5 hash of the server realm string without also checking the server's URL. A malicious server able to provide a realm that triggers an MD5 collision could possibly use this flaw to obtain the credentials for a different realm.
(CVE-2014-3528)

After installing the updated packages, for the update to take effect, you must restart the httpd daemon, if you are using mod_dav_svn, and the svnserve daemon, if you are serving Subversion repositories via the svn:// protocol.

Updated subversion packages that fix three security issues are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. The mod_dav_svn module is used with the Apache HTTP Server to allow access to Subversion repositories via HTTP.

A NULL pointer dereference flaw was found in the way the mod_dav_svn module handled REPORT requests. A remote, unauthenticated attacker could use a specially crafted REPORT request to crash mod_dav_svn.
(CVE-2014-3580)

A NULL pointer dereference flaw was found in the way the mod_dav_svn module handled certain requests for URIs that trigger a lookup of a virtual transaction name. A remote, unauthenticated attacker could send a request for a virtual transaction name that does not exist, causing mod_dav_svn to crash. (CVE-2014-8108)

It was discovered that Subversion clients retrieved cached authentication credentials using the MD5 hash of the server realm string without also checking the server's URL. A malicious server able to provide a realm that triggers an MD5 collision could possibly use this flaw to obtain the credentials for a different realm.
(CVE-2014-3528)

Red Hat would like to thank the Subversion project for reporting CVE-2014-3580 and CVE-2014-8108. Upstream acknowledges Evgeny Kotkov of VisualSVN as the original reporter.

All subversion users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, for the update to take effect, you must restart the httpd daemon, if you are using mod_dav_svn, and the svnserve daemon, if you are serving Subversion repositories via the svn:// protocol.

Updated subversion packages that fix two security issues are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. The mod_dav_svn module is used with the Apache HTTP Server to allow access to Subversion repositories via HTTP.

A NULL pointer dereference flaw was found in the way the mod_dav_svn module handled REPORT requests. A remote, unauthenticated attacker could use a specially crafted REPORT request to crash mod_dav_svn.
(CVE-2014-3580)

It was discovered that Subversion clients retrieved cached authentication credentials using the MD5 hash of the server realm string without also checking the server's URL. A malicious server able to provide a realm that triggers an MD5 collision could possibly use this flaw to obtain the credentials for a different realm.
(CVE-2014-3528)

Red Hat would like to thank the Subversion project for reporting CVE-2014-3580. Upstream acknowledges Evgeny Kotkov of VisualSVN as the original reporter.

All subversion users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, for the update to take effect, you must restart the httpd daemon, if you are using mod_dav_svn, and the svnserve daemon, if you are serving Subversion repositories via the svn:// protocol.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-0166 advisory.

    [1.7.14-7]
    - add security fixes for CVE-2014-3528, CVE-2014-3580, CVE-2014-8108

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2015:0165 :

Updated subversion packages that fix two security issues are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. The mod_dav_svn module is used with the Apache HTTP Server to allow access to Subversion repositories via HTTP.

A NULL pointer dereference flaw was found in the way the mod_dav_svn module handled REPORT requests. A remote, unauthenticated attacker could use a specially crafted REPORT request to crash mod_dav_svn.
(CVE-2014-3580)

It was discovered that Subversion clients retrieved cached authentication credentials using the MD5 hash of the server realm string without also checking the server's URL. A malicious server able to provide a realm that triggers an MD5 collision could possibly use this flaw to obtain the credentials for a different realm.
(CVE-2014-3528)

Red Hat would like to thank the Subversion project for reporting CVE-2014-3580. Upstream acknowledges Evgeny Kotkov of VisualSVN as the original reporter.

All subversion users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, for the update to take effect, you must restart the httpd daemon, if you are using mod_dav_svn, and the svnserve daemon, if you are serving Subversion repositories via the svn:// protocol.

The version of Subversion Server installed on the remote host is version 1.x.x prior to 1.7.18 or 1.8.x prior to 1.8.10. It is, therefore, affected by the following vulnerabilities :

  - A flaw exists in the Serf RA layer. This flaw causes     wildcards for HTTPS connections to be improperly     evaluated, which may result in the application     accepting certificates that are not matched against the     proper hostname. This may allow a remote     man-in-the-middle attacker to intercept traffic and     spoof valid sessions. (CVE-2014-3522)

  - An MD5 hash of the URL and authentication realm are     used to store cached credentials, which may allow     remote attackers to obtain these credentials via a     specially crafted authentication realm. (CVE-2014-3528)

Updated subversion packages fix security vulnerability :

Bert Huijben discovered that Subversion did not properly handle cached credentials. A malicious server could possibly use this issue to obtain credentials cached for a different server (CVE-2014-3528).

This update includes the latest stable release of **Apache Subversion** 1.7, version **1.7.18**, fixing a minor security issue.

**Client-side bugfixes:**

  - guard against md5 hash collisions when finding cached     credentials (CVE-2014-3528). See :

http://subversion.apache.org/security/CVE-2014-3528-advisory.txt

**Developer-visible changes** **General:**

  - fix ocassional failure in checkout_tests.py test 12.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This subversion and libserf update fixes several security and non security issues :

  - subversion: guard against md5 hash collisions when     finding cached credentials [bnc#889849] [CVE-2014-3528]

  - subversion: ra_serf: properly match wildcards in SSL     certs. [bnc#890511] [CVE-2014-3522]

  - libserf: Handle NUL bytes in fields of an X.509     certificate. [bnc#890510] [CVE-2014-3504]

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2316-1 advisory.

    Lieven Govaerts discovered that the Subversion mod_dav_svn module incorrectly handled certain request     methods when SVNListParentPath was enabled. A remote attacker could use this issue to cause the server to     crash, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS. (CVE-2014-0032)

    Ben Reser discovered that Subversion did not correctly validate SSL certificates containing wildcards. A     remote attacker could exploit this to perform a machine-in-the-middle attack to view sensitive information     or alter encrypted communications. (CVE-2014-3522)

    Bert Huijben discovered that Subversion did not properly handle cached credentials. A malicious server     could possibly use this issue to obtain credentials cached for a different server. (CVE-2014-3528)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Subversion Project reports :

Using the Serf RA layer of Subversion for HTTPS uses the apr_fnmatch API to handle matching wildcards in certificate Common Names and Subject Alternate Names. However, apr_fnmatch is not designed for this purpose. Instead it is designed to behave like common shell globbing.
In particular this means that '*' is not limited to a single label within a hostname (i.e. it will match '.'). But even further apr_fnmatch supports '?' and character classes (neither of which are part of the RFCs defining how certificate validation works).

Subversion stores cached credentials by an MD5 hash based on the URL and the authentication realm of the server the credentials are cached for. MD5 has been shown to be subject to chosen plaintext hash collisions. This means it may be possible to generate an authentication realm which results in the same MD5 hash for a different URL.

ID	Name	Product	Family	Severity
199213	RHEL 5 : subversion (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
93992	GLSA-201610-05 : Subversion, Serf: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
82338	Mandriva Linux Security Advisory : subversion (MDVSA-2015:085)	Nessus	Mandriva Local Security Checks	medium
81758	Apple Xcode < 6.2 (Mac OS X)	Nessus	MacOS X Local Security Checks	medium
81310	Scientific Linux Security Update : subversion on SL7.x x86_64 (20150210)	Nessus	Scientific Linux Local Security Checks	medium
81309	Scientific Linux Security Update : subversion on SL6.x i386/x86_64 (20150210)	Nessus	Scientific Linux Local Security Checks	medium
81293	RHEL 7 : subversion (RHSA-2015:0166)	Nessus	Red Hat Local Security Checks	medium
81292	RHEL 6 : subversion (RHSA-2015:0165)	Nessus	Red Hat Local Security Checks	medium
81289	Oracle Linux 7 : subversion (ELSA-2015-0166)	Nessus	Oracle Linux Local Security Checks	high
81288	Oracle Linux 6 : subversion (ELSA-2015-0165)	Nessus	Oracle Linux Local Security Checks	medium
81278	CentOS 7 : subversion (CESA-2015:0166)	Nessus	CentOS Local Security Checks	medium
81277	CentOS 6 : subversion (CESA-2015:0165)	Nessus	CentOS Local Security Checks	medium
78068	Apache Subversion 1.0.x - 1.7.17 / 1.8.x < 1.8.10 Multiple Vulnerabilities	Nessus	Windows	medium
77640	Mandriva Linux Security Advisory : subversion (MDVSA-2014:161)	Nessus	Mandriva Local Security Checks	medium
77423	Fedora 19 : subversion-1.7.18-1.fc19 (2014-9521)	Nessus	Fedora Local Security Checks	medium
77364	openSUSE Security Update : libserf / subversion (openSUSE-SU-2014:1059-1)	Nessus	SuSE Local Security Checks	medium
77219	Ubuntu 14.04 LTS : Subversion vulnerabilities (USN-2316-1)	Nessus	Ubuntu Local Security Checks	medium
77125	FreeBSD : subversion -- several vulnerabilities (83a418cc-2182-11e4-802c-20cf30e32f6d)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2014-3528

high

Tenable Plugins

critical

high

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium