The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a REPORT request for a resource that does not exist.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - subversion: Command injection through clients via malicious svn+ssh URLs (CVE-2017-9800)

  - Svnserve in Apache Subversion 1.4.0 through 1.7.12 and 1.8.0 through 1.8.1 allows local users to overwrite     arbitrary files or kill arbitrary processes via a symlink attack on the file specified by the --pid-file     option. (CVE-2013-4277)

  - Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL     and authentication realm to store cached credentials, which makes it easier for remote servers to obtain     the credentials via a crafted authentication realm. (CVE-2014-3528)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2721-1 advisory.

    It was discovered that the Subversion mod_dav_svn module incorrectly handled REPORT requests for a     resource that does not exist. A remote attacker could use this issue to cause the server to crash,     resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS.
    (CVE-2014-3580)

    It was discovered that the Subversion mod_dav_svn module incorrectly handled requests requiring a lookup     for a virtual transaction name that does not exist. A remote attacker could use this issue to cause the     server to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS.
    (CVE-2014-8108)

    Evgeny Kotkov discovered that the Subversion mod_dav_svn module incorrectly handled large numbers of     REPORT requests. A remote attacker could use this issue to cause the server to crash, resulting in a     denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-0202)

    Evgeny Kotkov discovered that the Subversion mod_dav_svn and svnserve modules incorrectly certain crafted     parameter combinations. A remote attacker could use this issue to cause the server to crash, resulting in     a denial of service. (CVE-2015-0248)

    Ivan Zhakov discovered that the Subversion mod_dav_svn module incorrectly handled crafted v1 HTTP protocol     request sequences. A remote attacker could use this issue to spoof the svn:author property.
    (CVE-2015-0251)

    C. Michael Pilato discovered that the Subversion mod_dav_svn module incorrectly restricted anonymous     access. A remote attacker could use this issue to read hidden files via the path name. This issue only     affected Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-3184)

    C. Michael Pilato discovered that Subversion incorrectly handled path-based authorization. A remote     attacker could use this issue to obtain sensitive path information. (CVE-2015-3187)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A NULL pointer dereference flaw was found in the way the mod_dav_svn module handled certain requests for URIs that trigger a lookup of a virtual transaction name. A remote, unauthenticated attacker could send a request for a virtual transaction name that does not exist, causing mod_dav_svn to crash. (CVE-2014-8108)

A NULL pointer dereference flaw was found in the way the mod_dav_svn module handled REPORT requests. A remote, unauthenticated attacker could use a specially crafted REPORT request to crash mod_dav_svn.
(CVE-2014-3580)

Evgeny Kotkov discovered a NULL pointer dereference while processing REPORT requests in mod_dav_svn, the Subversion component which is used to serve repositories with the Apache web server. A remote attacker could abuse this vulnerability for a denial of service.

We recommend that you upgrade your subversion packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Apple Xcode installed on the remote Mac OS X host is prior to version 6.2. It is, therefore, affected by the following vulnerabilities :

  - Numerous errors exist related to the bundled version of Apache Subversion. (CVE-2014-3522, CVE-2014-3528,     CVE-2014-3580, CVE-2014-8108)

  - An error exists related to the bundled version of Git that allows arbitrary files to be added to the .git     folder. (CVE-2014-9390)

A NULL pointer dereference flaw was found in the way the mod_dav_svn module handled REPORT requests. A remote, unauthenticated attacker could use a specially crafted REPORT request to crash mod_dav_svn.
(CVE-2014-3580)

A NULL pointer dereference flaw was found in the way the mod_dav_svn module handled certain requests for URIs that trigger a lookup of a virtual transaction name. A remote, unauthenticated attacker could send a request for a virtual transaction name that does not exist, causing mod_dav_svn to crash. (CVE-2014-8108)

It was discovered that Subversion clients retrieved cached authentication credentials using the MD5 hash of the server realm string without also checking the server's URL. A malicious server able to provide a realm that triggers an MD5 collision could possibly use this flaw to obtain the credentials for a different realm.
(CVE-2014-3528)

After installing the updated packages, for the update to take effect, you must restart the httpd daemon, if you are using mod_dav_svn, and the svnserve daemon, if you are serving Subversion repositories via the svn:// protocol.

A NULL pointer dereference flaw was found in the way the mod_dav_svn module handled REPORT requests. A remote, unauthenticated attacker could use a specially crafted REPORT request to crash mod_dav_svn.
(CVE-2014-3580)

It was discovered that Subversion clients retrieved cached authentication credentials using the MD5 hash of the server realm string without also checking the server's URL. A malicious server able to provide a realm that triggers an MD5 collision could possibly use this flaw to obtain the credentials for a different realm.
(CVE-2014-3528)

After installing the updated packages, for the update to take effect, you must restart the httpd daemon, if you are using mod_dav_svn, and the svnserve daemon, if you are serving Subversion repositories via the svn:// protocol.

Updated subversion packages that fix three security issues are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. The mod_dav_svn module is used with the Apache HTTP Server to allow access to Subversion repositories via HTTP.

A NULL pointer dereference flaw was found in the way the mod_dav_svn module handled REPORT requests. A remote, unauthenticated attacker could use a specially crafted REPORT request to crash mod_dav_svn.
(CVE-2014-3580)

A NULL pointer dereference flaw was found in the way the mod_dav_svn module handled certain requests for URIs that trigger a lookup of a virtual transaction name. A remote, unauthenticated attacker could send a request for a virtual transaction name that does not exist, causing mod_dav_svn to crash. (CVE-2014-8108)

It was discovered that Subversion clients retrieved cached authentication credentials using the MD5 hash of the server realm string without also checking the server's URL. A malicious server able to provide a realm that triggers an MD5 collision could possibly use this flaw to obtain the credentials for a different realm.
(CVE-2014-3528)

Red Hat would like to thank the Subversion project for reporting CVE-2014-3580 and CVE-2014-8108. Upstream acknowledges Evgeny Kotkov of VisualSVN as the original reporter.

All subversion users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, for the update to take effect, you must restart the httpd daemon, if you are using mod_dav_svn, and the svnserve daemon, if you are serving Subversion repositories via the svn:// protocol.

Updated subversion packages that fix two security issues are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. The mod_dav_svn module is used with the Apache HTTP Server to allow access to Subversion repositories via HTTP.

A NULL pointer dereference flaw was found in the way the mod_dav_svn module handled REPORT requests. A remote, unauthenticated attacker could use a specially crafted REPORT request to crash mod_dav_svn.
(CVE-2014-3580)

It was discovered that Subversion clients retrieved cached authentication credentials using the MD5 hash of the server realm string without also checking the server's URL. A malicious server able to provide a realm that triggers an MD5 collision could possibly use this flaw to obtain the credentials for a different realm.
(CVE-2014-3528)

Red Hat would like to thank the Subversion project for reporting CVE-2014-3580. Upstream acknowledges Evgeny Kotkov of VisualSVN as the original reporter.

All subversion users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, for the update to take effect, you must restart the httpd daemon, if you are using mod_dav_svn, and the svnserve daemon, if you are serving Subversion repositories via the svn:// protocol.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-0166 advisory.

    [1.7.14-7]
    - add security fixes for CVE-2014-3528, CVE-2014-3580, CVE-2014-8108

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2015:0165 :

Updated subversion packages that fix two security issues are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. The mod_dav_svn module is used with the Apache HTTP Server to allow access to Subversion repositories via HTTP.

A NULL pointer dereference flaw was found in the way the mod_dav_svn module handled REPORT requests. A remote, unauthenticated attacker could use a specially crafted REPORT request to crash mod_dav_svn.
(CVE-2014-3580)

It was discovered that Subversion clients retrieved cached authentication credentials using the MD5 hash of the server realm string without also checking the server's URL. A malicious server able to provide a realm that triggers an MD5 collision could possibly use this flaw to obtain the credentials for a different realm.
(CVE-2014-3528)

Red Hat would like to thank the Subversion project for reporting CVE-2014-3580. Upstream acknowledges Evgeny Kotkov of VisualSVN as the original reporter.

All subversion users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, for the update to take effect, you must restart the httpd daemon, if you are using mod_dav_svn, and the svnserve daemon, if you are serving Subversion repositories via the svn:// protocol.

The remote host is running a version of Apache SVN 1.7.x prior to 1.7.19 or 1.8.x prior to 1.8.11. It is, therefore, affected by multiple denial of service vulnerabilities :

  - A NULL pointer dereference flaw exists in 'mod_dav_svn'     that is triggered when handling REPORT requests. A     remote attacker, using a specially crafted request, can     cause the listener process to crash. (CVE-2014-3580)

  - A NULL pointer dereference flaw exists in 'mod_dav_svn'     that is triggered when handling requests for     non-existent virtual transaction names. A remote     attacker, using a specially crafted request, can cause     the listener process to crash. (CVE-2014-8108)

Versions of Apache Subversion prior to 1.7.19, or 1.8.x prior to 1.8.11 are affected by the following vulnerabilities :

 - When a resource is requested by 'mod_dav' that doesn't exist, 'mod_dav_svn' returns a NULL as the repository path. However, later when 'mod_dav' calls to handle the request, a SEGFAULT occurs, effectively crashing the service. (CVE-2014-3580)
 - A denial of service vulnerability affects the 'mod_dav_svn' module for the Apache HTTPD server. The problem occurs when handling a request for specially formatted URIs. The request would include a non-existent virtual transaction name, resulting in a NULL loop, effectively crashing the service. (CVE-2014-8108)

Updated subversion packages fix security vulnerabilities :

A NULL pointer dereference flaw was found in the way mod_dav_svn handled REPORT requests. A remote, unauthenticated attacker could use a crafted REPORT request to crash mod_dav_svn (CVE-2014-3580).

A NULL pointer dereference flaw was found in the way mod_dav_svn handled URIs for virtual transaction names. A remote, unauthenticated attacker could send a request for a virtual transaction name that does not exist, causing mod_dav_svn to crash (CVE-2014-8108).

This update includes the latest stable release of **Apache Subversion**, version **1.8.11**. Two security issues in mod_dav_svn are addressed in this release (CVE-2014-8108, CVE-2014-3580). For more details, see :

http://subversion.apache.org/security/CVE-2014-8108-advisory.txt http://subversion.apache.org/security/CVE-2014-3580-advisory.txt

**Client-side bugfixes:**

  - checkout/update: fix file externals failing to follow     history and subsequently silently failing     http://subversion.tigris.org/issues/show_bug.cgi?id=4185

    - patch: don't skip targets in valid --git difs

    - diff: make property output in diffs stable

    - diff: fix diff of local copied directory with props

    - diff: fix changelist filter for repos-WC and WC-WC

    - remove broken conflict resolver menu options that       always error out

    - improve gpg-agent support

    - fix crash in eclipse IDE with GNOME Keyring       http://subversion.tigris.org/issues/show_bug.cgi?id=34       98

    - fix externals shadowing a versioned directory       http://subversion.tigris.org/issues/show_bug.cgi?id=40       85

    - fix problems working on unix file systems that don't       support permissions

    - upgrade: keep external registrations       http://subversion.tigris.org/issues/show_bug.cgi?id=45       19

    - cleanup: iprove performance of recorded timestamp       fixups

    - translation updates for German

**Server-side bugfixes:**

  - disable revprop caching feature due to cache     invalidation problems

    - skip generating uniquifiers if rep-sharing is not       supported

    - mod_dav_svn: reject requests with missing repository       paths

    - mod_dav_svn: reject requests with invalid virtual       transaction names

    - mod_dav_svn: avoid unneeded memory growth in resource       walking       http://subversion.tigris.org/issues/show_bug.cgi?id=45       31

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This Apache Subversion update fixes the following security and non security issues.

  - Apache Subversion 1.8.11

  - This release addresses two security issues: [boo#909935]

  - CVE-2014-3580: mod_dav_svn DoS from invalid REPORT     requests.

  - CVE-2014-8108: mod_dav_svn DoS from use of invalid     transaction names.

  - Client-side bugfixes :

  - checkout/update: fix file externals failing to follow     history and subsequently silently failing

  - patch: don't skip targets in valid --git difs

  - diff: make property output in diffs stable

  - diff: fix diff of local copied directory with props

  - diff: fix changelist filter for repos-WC and WC-WC

  - remove broken conflict resolver menu options that always     error out

  - improve gpg-agent support

  - fix crash in eclipse IDE with GNOME Keyring

  - fix externals shadowing a versioned directory

  - fix problems working on unix file systems that don't     support permissions

  - upgrade: keep external registrations

  - cleanup: iprove performance of recorded timestamp fixups

  - translation updates for German

  - Server-side bugfixes :

  - disable revprop caching feature due to cache     invalidation problems

  - skip generating uniquifiers if rep-sharing is not     supported

  - mod_dav_svn: reject requests with missing repository     paths

  - mod_dav_svn: reject requests with invalid virtual     transaction names

  - mod_dav_svn: avoid unneeded memory growth in resource     walking

Evgeny Kotkov discovered a NULL pointer dereference while processing REPORT requests in mod_dav_svn, the Subversion component which is used to serve repositories with the Apache web server. A remote attacker could abuse this vulnerability for a denial of service.

Subversion Project reports :

Subversion's mod_dav_svn Apache HTTPD server module will crash when it receives a REPORT request for some invalid formatted special URIs.

Subversion's mod_dav_svn Apache HTTPD server module will crash when it receives a request for some invalid formatted special URIs.

We consider this to be a medium risk vulnerability. Repositories which allow for anonymous reads will be vulnerable without authentication.
Unfortunately, no special configuration is required and all mod_dav_svn servers are vulnerable.

ID	Name	Product	Family	Severity
199213	RHEL 5 : subversion (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
85579	Ubuntu 14.04 LTS : Subversion vulnerabilities (USN-2721-1)	Nessus	Ubuntu Local Security Checks	high
84372	Amazon Linux AMI : mod_dav_svn / subversion (ALAS-2015-555)	Nessus	Amazon Linux Local Security Checks	medium
82102	Debian DLA-119-1 : subversion security update	Nessus	Debian Local Security Checks	medium
81758	Apple Xcode < 6.2 (Mac OS X)	Nessus	MacOS X Local Security Checks	medium
81310	Scientific Linux Security Update : subversion on SL7.x x86_64 (20150210)	Nessus	Scientific Linux Local Security Checks	medium
81309	Scientific Linux Security Update : subversion on SL6.x i386/x86_64 (20150210)	Nessus	Scientific Linux Local Security Checks	medium
81293	RHEL 7 : subversion (RHSA-2015:0166)	Nessus	Red Hat Local Security Checks	medium
81292	RHEL 6 : subversion (RHSA-2015:0165)	Nessus	Red Hat Local Security Checks	medium
81289	Oracle Linux 7 : subversion (ELSA-2015-0166)	Nessus	Oracle Linux Local Security Checks	high
81288	Oracle Linux 6 : subversion (ELSA-2015-0165)	Nessus	Oracle Linux Local Security Checks	medium
81278	CentOS 7 : subversion (CESA-2015:0166)	Nessus	CentOS Local Security Checks	medium
81277	CentOS 6 : subversion (CESA-2015:0165)	Nessus	CentOS Local Security Checks	medium
80864	Apache Subversion 1.7.x < 1.7.19 / 1.8.x < 1.8.11 Multiple Remote DoS	Nessus	Web Servers	medium
8616	Apache Subversion < 1.7.19 / 1.8.x < 1.8.11 Multiple DoS	Nessus Network Monitor	Web Servers	medium
80386	Mandriva Linux Security Advisory : subversion (MDVSA-2015:005)	Nessus	Mandriva Local Security Checks	medium
80375	Fedora 20 : subversion-1.8.11-1.fc20 (2014-17222)	Nessus	Fedora Local Security Checks	medium
80373	Fedora 21 : subversion-1.8.11-1.fc21 (2014-17118)	Nessus	Fedora Local Security Checks	medium
80299	openSUSE Security Update : subversion (openSUSE-SU-2014:1725-1)	Nessus	SuSE Local Security Checks	medium
80207	Debian DSA-3107-1 : subversion - security update	Nessus	Debian Local Security Checks	medium
80039	FreeBSD : subversion -- DoS vulnerabilities (f5561ade-846c-11e4-b7a7-20cf30e32f6d)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2014-3580

high

Tenable Plugins

critical

high

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium