mod_authz_svn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, when using Apache httpd 2.4.x, does not properly restrict anonymous access, which allows remote anonymous users to read hidden files via the path name.

The remote host is affected by the vulnerability described in GLSA-201610-05 (Subversion, Serf: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Subversion and Serf.
      Please review the CVE identifiers referenced below for details   Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, conduct a man-in-the-middle attack, obtain       sensitive information, or cause a Denial of Service Condition.
  Workaround :

    There is no known workaround at this time.

It was found that when an SVN server (both svnserve and httpd with the mod_dav_svn module) searched the history of a file or a directory, it would disclose its location in the repository if that file or directory was not readable (for example, if it had been moved).
(CVE-2015-3187)

An integer overflow was discovered allowing remote attackers to execute arbitrary code via an svn:// protocol string, which triggers a heap-based buffer overflow and an out-of-bounds read. (CVE-2015-5259)

It was found that the mod_authz_svn module did not properly restrict anonymous access to Subversion repositories under certain configurations when used with Apache httpd 2.4.x. This could allow a user to anonymously access files in a Subversion repository, which should only be accessible to authenticated users. (CVE-2015-3184)

It was found that the mod_dav_svn module was vulnerable to a remotely triggerable heap-based buffer overflow and out-of-bounds read caused by an integer overflow when parsing skel-encoded request bodies, allowing an attacker with write access to a repository to cause a denial of service attack (on 32-bit or 64-bit servers) or possibly execute arbitrary code (on 32-bit servers only) under the context of the httpd process. (CVE-2015-5343)

The version of Apple Xcode installed on the remote Mac OS X host is prior to 7.3. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in Apache Subversion in mod_authz_svn due to a failure to properly restrict anonymous     access. An unauthenticated, remote attacker can exploit this, via a crafted path name, to read hidden     files. (CVE-2015-3184)

  - A flaw exists in Apache Subversion in the svn_repos_trace_node_locations() function that causes the first     readable path to be returned when it encounters an unreadable path when following a node's history. An     authenticated, remote attacker can exploit this to access paths that were intended to be hidden.
    (CVE-2015-3187)

  - Multiple unspecified memory corruption issues exist in otool due to improper validation of user-supplied     input. A local attacker can exploit these to cause a denial of service or to execute arbitrary code.
    (CVE-2016-1765)

This update includes the latest stable release of _Apache Subversion 1.8_, version **1.8.15**. This update fixes two security issues: *
**CVE-2015-3184**: Subversion's mod_authz_svn does not properly restrict anonymous access in some mixed anonymous/authenticated environments when using Apache httpd 2.4.
http://subversion.apache.org/security/CVE-2015-3184-advisory.txt *
**CVE-2015-3187**: Subversion servers, both httpd and svnserve, will reveal some paths that should be hidden by path-based authz.
http://subversion.apache.org/security/CVE-2015-3187-advisory.txt ### User- visible changes: #### Client-side bugfixes: * gpg-agent: fix crash with non- canonical $HOME * document svn:autoprops * cp: fix 'svn cp ^/A/D/H at 1 ^/A' to properly create A * resolve: improve conflict prompts for binary files * ls: improve performance of '-v' on tag directories * improved Sqlite 3.8.9 query performance regression on externals * fixed [issue 4580](http://subversion.tigris.org/issues/show_bug.cgi?id=4580): 'svn
-v st' on file externals reports '?' instead of user and revision after 'svn up' #### Client-side and server-side bugfixes: * fix a segfault with old style text delta #### Server-side bugfixes: * fsfs:
reduce memory allocation with Apache * mod_dav_svn: emit first log items as soon as possible * mod_dav_svn: use LimitXMLRequestBody for skel-encoded requests * mod_dav_svn: do not ignore skel parsing errors
* detect invalid svndiff data earlier * prevent possible repository corruption on power/disk failures * fixed [issue 4577](http://subversion.tigris.org/issues/show_bug.cgi?id=4577): Read error with nodes whose DELTA chain starts with a PLAIN rep * fixed [issue 4531](http://subversion.tigris.org/issues/show_bug.cgi?id=4531):
server-side copy (over dav) is slow and uses too much memory #### Bindings bugfixes: * swig: fix memory corruption in svn_client_copy_source_t ### Developer-visible changes: #### General:
* avoid failing some tests on versions of Python with a very old sqlite * fix Ruby tests so they don't use the users real configuration #### Bindings: * swig-pl: fix some stack memory problems

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following security issues :

  - CVE-2015-5343: Possible remotely triggerable heap     overflow and out-of-bounds read in mod_dav_svn caused by     integer overflow when parsing skel-encoded request     bodies. (bsc#958300)

  - CVE-2015-3184: mod_authz_svn information leak     information in mixed anonymous/authenticated httpd (dav)     configurations (bsc#939514)

  - CVE-2015-3187: hidden paths leaked by path-based authz     (bsc#939517)

Updated subversion packages that fix multiple security issues are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. The mod_dav_svn module is used with the Apache HTTP Server to allow access to Subversion repositories via HTTP.

An assertion failure flaw was found in the way the SVN server processed certain requests with dynamically evaluated revision numbers. A remote attacker could use this flaw to cause the SVN server (both svnserve and httpd with the mod_dav_svn module) to crash.
(CVE-2015-0248)

It was found that the mod_authz_svn module did not properly restrict anonymous access to Subversion repositories under certain configurations when used with Apache httpd 2.4.x. This could allow a user to anonymously access files in a Subversion repository, which should only be accessible to authenticated users. (CVE-2015-3184)

It was found that the mod_dav_svn module did not properly validate the svn:author property of certain requests. An attacker able to create new revisions could use this flaw to spoof the svn:author property.
(CVE-2015-0251)

It was found that when an SVN server (both svnserve and httpd with the mod_dav_svn module) searched the history of a file or a directory, it would disclose its location in the repository if that file or directory was not readable (for example, if it had been moved).
(CVE-2015-3187)

Red Hat would like to thank the Apache Software Foundation for reporting these issues. Upstream acknowledges Evgeny Kotkov of VisualSVN as the original reporter of CVE-2015-0248 and CVE-2015-0251, and C. Michael Pilato of CollabNet as the original reporter of CVE-2015-3184 and CVE-2015-3187 flaws.

All subversion users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, for the update to take effect, you must restart the httpd daemon, if you are using mod_dav_svn, and the svnserve daemon, if you are serving Subversion repositories via the svn:// protocol.

The version of Apache Subversion installed on the remote host is 1.7.x prior to 1.7.21, or 1.8.x prior to 1.8.14 and is affected by the following vulnerabilities :

 - A security bypass flaw affects the 'mod_authz_svn' module as it does not properly restrict anonymous access in some mixed anonymous/authenticated environments when using Subversion with Apache httpd 2.4. (CVE-2015-3184) 
 - An information disclosure flaw affects 'authz'. Subversion servers, both httpd and svnserve, will reveal some paths that should be hidden by path-based authz controls. (CVE-2015-3187)

The version of Apache HTTP Server 2.4 installed on the remote host is prior to 2.4.13. It is, therefore, affected by the following vulnerabilities : 

 - A flaw exists in the lua_websocket_read() function in the 'mod_lua' module due to incorrect handling of WebSocket PING frames. A remote attacker can exploit this, by sending a crafted WebSocket PING frame after a Lua script has called the wsupgrade() function, to crash a child process, resulting in a denial of service condition. (CVE-2015-0228) 
 - A NULL pointer dereference flaw exists in the read_request_line() function due to a failure to initialize the protocol structure member. A remote  attacker can exploit this flaw, on installations that enable the INCLUDES filter and has an ErrorDocument 400 directive specifying a local URI, by sending a request that lacks a method, to cause a denial of service condition. (CVE-2015-0253) 
 - A flaw exists in the chunked transfer coding implementation due to a failure to properly parse chunk headers. A remote attacker can exploit this to conduct HTTP request smuggling attacks. (CVE-2015-3183) 
 - A security bypass flaw affects mod_authz_svn related to a failure to properly restrict anonymous access. This may allow anonymous access in scenarios where it is intended to be restricted to authenticated users. (CVE-2015-3184) 
 - A flaw exists in the ap_some_auth_required() function due to a failure to consider that a Require directive may be associated with an authorization setting rather than an authentication setting. A remote attacker can exploit this, if a module that relies on the 2.2 API behavior exists, to bypass intended access restrictions. (CVE-2015-3185) 
 - A flaw exists in the RC4 algorithm due to an initial double-byte bias in the keystream generation. An attacker can exploit this, via Bayesian analysis that combines a priori plaintext distribution with keystream distribution statistics, to conduct a plaintext recovery of the ciphertext. Note that RC4 cipher suites are now prohibited per RFC 7465. This issue was fixed in Apache version 2.4.13; however, 2.4.13, 2.4.14, and 2.4.15 were never publicly released. (CVE-2015-2808)

An assertion failure flaw was found in the way the SVN server processed certain requests with dynamically evaluated revision numbers. A remote attacker could use this flaw to cause the SVN server (both svnserve and httpd with the mod_dav_svn module) to crash.
(CVE-2015-0248)

It was found that the mod_authz_svn module did not properly restrict anonymous access to Subversion repositories under certain configurations when used with Apache httpd 2.4.x. This could allow a user to anonymously access files in a Subversion repository, which should only be accessible to authenticated users. (CVE-2015-3184)

It was found that the mod_dav_svn module did not properly validate the svn:author property of certain requests. An attacker able to create new revisions could use this flaw to spoof the svn:author property.
(CVE-2015-0251)

It was found that when an SVN server (both svnserve and httpd with the mod_dav_svn module) searched the history of a file or a directory, it would disclose its location in the repository if that file or directory was not readable (for example, if it had been moved).
(CVE-2015-3187)

After installing the updated packages, for the update to take effect, you must restart the httpd daemon, if you are using mod_dav_svn, and the svnserve daemon, if you are serving Subversion repositories via the svn:// protocol.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1742 advisory.

    [1.7.14-7.1]
    - add security fixes for CVE-2015-0248, CVE-2015-0251, CVE-2015-3184,       CVE-2015-3187

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2721-1 advisory.

    It was discovered that the Subversion mod_dav_svn module incorrectly handled REPORT requests for a     resource that does not exist. A remote attacker could use this issue to cause the server to crash,     resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS.
    (CVE-2014-3580)

    It was discovered that the Subversion mod_dav_svn module incorrectly handled requests requiring a lookup     for a virtual transaction name that does not exist. A remote attacker could use this issue to cause the     server to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS.
    (CVE-2014-8108)

    Evgeny Kotkov discovered that the Subversion mod_dav_svn module incorrectly handled large numbers of     REPORT requests. A remote attacker could use this issue to cause the server to crash, resulting in a     denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-0202)

    Evgeny Kotkov discovered that the Subversion mod_dav_svn and svnserve modules incorrectly certain crafted     parameter combinations. A remote attacker could use this issue to cause the server to crash, resulting in     a denial of service. (CVE-2015-0248)

    Ivan Zhakov discovered that the Subversion mod_dav_svn module incorrectly handled crafted v1 HTTP protocol     request sequences. A remote attacker could use this issue to spoof the svn:author property.
    (CVE-2015-0251)

    C. Michael Pilato discovered that the Subversion mod_dav_svn module incorrectly restricted anonymous     access. A remote attacker could use this issue to read hidden files via the path name. This issue only     affected Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-3184)

    C. Michael Pilato discovered that Subversion incorrectly handled path-based authorization. A remote     attacker could use this issue to obtain sensitive path information. (CVE-2015-3187)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

subversion was updated to version 1.8.14 to fix two security issues.

These security issues were fixed :

  - CVE-2015-3187: Information leak (only paths) that were     hidden by path-based authz (bsc#939517).

  - CVE-2015-3184: Information leak in mixed     anonymous/authenticated httpd (dav) configurations     (bsc#939514).

Several security issues have been found in the server components of the version control system subversion.

  - CVE-2015-3184     Subversion's mod_authz_svn does not properly restrict     anonymous access in some mixed anonymous/authenticated     environments when using Apache httpd 2.4. The result is     that anonymous access may be possible to files for which     only authenticated access should be possible. This issue     does not affect the oldstable distribution (wheezy)     because it only contains Apache httpd 2.2.

  - CVE-2015-3187     Subversion servers, both httpd and svnserve, will reveal     some paths that should be hidden by path-based authz.
    When a node is copied from an unreadable location to a     readable location the unreadable path may be revealed.
    This vulnerablity only reveals the path, it does not     reveal the contents of the path.

Subversion reports :

CVE-2015-3184 : Subversion's mod_authz_svn does not properly restrict anonymous access in some mixed anonymous/authenticated environments when using Apache httpd 2.4.

CVE-2015-3187 : Subversion servers, both httpd and svnserve, will reveal some paths that should be hidden by path-based authz.

ID	Name	Product	Family	Severity
93992	GLSA-201610-05 : Subversion, Serf: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
90269	Amazon Linux AMI : mod_dav_svn / subversion (ALAS-2016-676)	Nessus	Amazon Linux Local Security Checks	high
90148	Apple Xcode < 7.3 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	medium
89276	Fedora 22 : subversion-1.8.15-1.fc22 (2015-6efa349a85)	Nessus	Fedora Local Security Checks	high
87624	openSUSE Security Update : subversion (openSUSE-2015-949)	Nessus	SuSE Local Security Checks	high
86510	CentOS 7 : subversion (CESA-2015:1742)	Nessus	CentOS Local Security Checks	medium
8973	Apache Subversion 1.7.x < 1.7.21 / 1.8.x < 1.8.14 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
8970	Apache HTTP Server 2.4.x < 2.4.16 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
85978	RHEL 7 : subversion (RHSA-2015:1742)	Nessus	Red Hat Local Security Checks	medium
85867	Scientific Linux Security Update : subversion on SL7.x x86_64 (20150908)	Nessus	Scientific Linux Local Security Checks	medium
85865	Oracle Linux 7 : subversion (ELSA-2015-1742)	Nessus	Oracle Linux Local Security Checks	high
85579	Ubuntu 14.04 LTS : Subversion vulnerabilities (USN-2721-1)	Nessus	Ubuntu Local Security Checks	high
85524	openSUSE Security Update : subversion (openSUSE-2015-549)	Nessus	SuSE Local Security Checks	medium
85354	Debian DSA-3331-1 : subversion - security update	Nessus	Debian Local Security Checks	medium
85257	FreeBSD : subversion -- multiple vulnerabilities (57bb5e3d-3c4f-11e5-a4d4-001e8c75030d)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2015-3184

high

Tenable Plugins

high

high

medium

high

high

medium

medium

medium

medium

medium

high

high

medium

medium

medium