The svn_repos_trace_node_locations function in Apache Subversion before 1.7.21 and 1.8.x before 1.8.14, when path-based authorization is used, allows remote authenticated users to obtain sensitive path information by reading the history of a node that has been moved from a hidden path.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - subversion: Command injection through clients via malicious svn+ssh URLs (CVE-2017-9800)

  - Svnserve in Apache Subversion 1.4.0 through 1.7.12 and 1.8.0 through 1.8.1 allows local users to overwrite     arbitrary files or kill arbitrary processes via a symlink attack on the file specified by the --pid-file     option. (CVE-2013-4277)

  - Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL     and authentication realm to store cached credentials, which makes it easier for remote servers to obtain     the credentials via a crafted authentication realm. (CVE-2014-3528)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote host is affected by the vulnerability described in GLSA-201610-05 (Subversion, Serf: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Subversion and Serf.
      Please review the CVE identifiers referenced below for details   Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, conduct a man-in-the-middle attack, obtain       sensitive information, or cause a Denial of Service Condition.
  Workaround :

    There is no known workaround at this time.

It was found that when an SVN server (both svnserve and httpd with the mod_dav_svn module) searched the history of a file or a directory, it would disclose its location in the repository if that file or directory was not readable (for example, if it had been moved).
(CVE-2015-3187)

An integer overflow was discovered allowing remote attackers to execute arbitrary code via an svn:// protocol string, which triggers a heap-based buffer overflow and an out-of-bounds read. (CVE-2015-5259)

It was found that the mod_authz_svn module did not properly restrict anonymous access to Subversion repositories under certain configurations when used with Apache httpd 2.4.x. This could allow a user to anonymously access files in a Subversion repository, which should only be accessible to authenticated users. (CVE-2015-3184)

It was found that the mod_dav_svn module was vulnerable to a remotely triggerable heap-based buffer overflow and out-of-bounds read caused by an integer overflow when parsing skel-encoded request bodies, allowing an attacker with write access to a repository to cause a denial of service attack (on 32-bit or 64-bit servers) or possibly execute arbitrary code (on 32-bit servers only) under the context of the httpd process. (CVE-2015-5343)

The version of Apple Xcode installed on the remote Mac OS X host is prior to 7.3. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in Apache Subversion in mod_authz_svn due to a failure to properly restrict anonymous     access. An unauthenticated, remote attacker can exploit this, via a crafted path name, to read hidden     files. (CVE-2015-3184)

  - A flaw exists in Apache Subversion in the svn_repos_trace_node_locations() function that causes the first     readable path to be returned when it encounters an unreadable path when following a node's history. An     authenticated, remote attacker can exploit this to access paths that were intended to be hidden.
    (CVE-2015-3187)

  - Multiple unspecified memory corruption issues exist in otool due to improper validation of user-supplied     input. A local attacker can exploit these to cause a denial of service or to execute arbitrary code.
    (CVE-2016-1765)

This update fixes the following security issues :

  - CVE-2015-5343: Possible remotely triggerable heap     overflow and out-of-bounds read in mod_dav_svn caused by     integer overflow when parsing skel-encoded request     bodies. (bsc#958300)

  - CVE-2015-3184: mod_authz_svn information leak     information in mixed anonymous/authenticated httpd (dav)     configurations (bsc#939514)

  - CVE-2015-3187: hidden paths leaked by path-based authz     (bsc#939517)

Updated subversion packages that fix multiple security issues are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. The mod_dav_svn module is used with the Apache HTTP Server to allow access to Subversion repositories via HTTP.

An assertion failure flaw was found in the way the SVN server processed certain requests with dynamically evaluated revision numbers. A remote attacker could use this flaw to cause the SVN server (both svnserve and httpd with the mod_dav_svn module) to crash.
(CVE-2015-0248)

It was found that the mod_authz_svn module did not properly restrict anonymous access to Subversion repositories under certain configurations when used with Apache httpd 2.4.x. This could allow a user to anonymously access files in a Subversion repository, which should only be accessible to authenticated users. (CVE-2015-3184)

It was found that the mod_dav_svn module did not properly validate the svn:author property of certain requests. An attacker able to create new revisions could use this flaw to spoof the svn:author property.
(CVE-2015-0251)

It was found that when an SVN server (both svnserve and httpd with the mod_dav_svn module) searched the history of a file or a directory, it would disclose its location in the repository if that file or directory was not readable (for example, if it had been moved).
(CVE-2015-3187)

Red Hat would like to thank the Apache Software Foundation for reporting these issues. Upstream acknowledges Evgeny Kotkov of VisualSVN as the original reporter of CVE-2015-0248 and CVE-2015-0251, and C. Michael Pilato of CollabNet as the original reporter of CVE-2015-3184 and CVE-2015-3187 flaws.

All subversion users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, for the update to take effect, you must restart the httpd daemon, if you are using mod_dav_svn, and the svnserve daemon, if you are serving Subversion repositories via the svn:// protocol.

The version of Apache Subversion installed on the remote host is 1.7.x prior to 1.7.21, or 1.8.x prior to 1.8.14 and is affected by the following vulnerabilities :

 - A security bypass flaw affects the 'mod_authz_svn' module as it does not properly restrict anonymous access in some mixed anonymous/authenticated environments when using Subversion with Apache httpd 2.4. (CVE-2015-3184) 
 - An information disclosure flaw affects 'authz'. Subversion servers, both httpd and svnserve, will reveal some paths that should be hidden by path-based authz controls. (CVE-2015-3187)

An assertion failure flaw was found in the way the SVN server processed certain requests with dynamically evaluated revision numbers. A remote attacker could use this flaw to cause the SVN server (both svnserve and httpd with the mod_dav_svn module) to crash.
(CVE-2015-0248)

It was found that the mod_authz_svn module did not properly restrict anonymous access to Subversion repositories under certain configurations when used with Apache httpd 2.4.x. This could allow a user to anonymously access files in a Subversion repository, which should only be accessible to authenticated users. (CVE-2015-3184)

It was found that the mod_dav_svn module did not properly validate the svn:author property of certain requests. An attacker able to create new revisions could use this flaw to spoof the svn:author property.
(CVE-2015-0251)

It was found that when an SVN server (both svnserve and httpd with the mod_dav_svn module) searched the history of a file or a directory, it would disclose its location in the repository if that file or directory was not readable (for example, if it had been moved).
(CVE-2015-3187)

After installing the updated packages, for the update to take effect, you must restart the httpd daemon, if you are using mod_dav_svn, and the svnserve daemon, if you are serving Subversion repositories via the svn:// protocol.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1742 advisory.

    [1.7.14-7.1]
    - add security fixes for CVE-2015-0248, CVE-2015-0251, CVE-2015-3184,       CVE-2015-3187

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2721-1 advisory.

    It was discovered that the Subversion mod_dav_svn module incorrectly handled REPORT requests for a     resource that does not exist. A remote attacker could use this issue to cause the server to crash,     resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS.
    (CVE-2014-3580)

    It was discovered that the Subversion mod_dav_svn module incorrectly handled requests requiring a lookup     for a virtual transaction name that does not exist. A remote attacker could use this issue to cause the     server to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS.
    (CVE-2014-8108)

    Evgeny Kotkov discovered that the Subversion mod_dav_svn module incorrectly handled large numbers of     REPORT requests. A remote attacker could use this issue to cause the server to crash, resulting in a     denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-0202)

    Evgeny Kotkov discovered that the Subversion mod_dav_svn and svnserve modules incorrectly certain crafted     parameter combinations. A remote attacker could use this issue to cause the server to crash, resulting in     a denial of service. (CVE-2015-0248)

    Ivan Zhakov discovered that the Subversion mod_dav_svn module incorrectly handled crafted v1 HTTP protocol     request sequences. A remote attacker could use this issue to spoof the svn:author property.
    (CVE-2015-0251)

    C. Michael Pilato discovered that the Subversion mod_dav_svn module incorrectly restricted anonymous     access. A remote attacker could use this issue to read hidden files via the path name. This issue only     affected Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-3184)

    C. Michael Pilato discovered that Subversion incorrectly handled path-based authorization. A remote     attacker could use this issue to obtain sensitive path information. (CVE-2015-3187)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

subversion was updated to version 1.8.14 to fix two security issues.

These security issues were fixed :

  - CVE-2015-3187: Information leak (only paths) that were     hidden by path-based authz (bsc#939517).

  - CVE-2015-3184: Information leak in mixed     anonymous/authenticated httpd (dav) configurations     (bsc#939514).

An assertion failure flaw was found in the way the SVN server processed certain requests with dynamically evaluated revision numbers. A remote attacker could use this flaw to cause the SVN server (both svnserve and httpd with the mod_dav_svn module) to crash.
(CVE-2015-0248)

It was found that the mod_dav_svn module did not properly validate the svn:author property of certain requests. An attacker able to create new revisions could use this flaw to spoof the svn:author property.
(CVE-2015-0251)

It was found that when an SVN server (both svnserve and httpd with the mod_dav_svn module) searched the history of a file or a directory, it would disclose its location in the repository if that file or directory was not readable (for example, if it had been moved).
(CVE-2015-3187)

After installing the updated packages, for the update to take effect, you must restart the httpd daemon, if you are using mod_dav_svn, and the svnserve daemon, if you are serving Subversion repositories via the svn:// protocol.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1633 advisory.

    Subversion (SVN) is a concurrent version control system which enables one     or more users to collaborate in developing and maintaining a hierarchy of     files and directories while keeping a history of all changes.
    The mod_dav_svn module is used with the Apache HTTP Server to allow access     to Subversion repositories via HTTP.

    An assertion failure flaw was found in the way the SVN server processed     certain requests with dynamically evaluated revision numbers. A remote     attacker could use this flaw to cause the SVN server (both svnserve and     httpd with the mod_dav_svn module) to crash. (CVE-2015-0248)

    It was found that the mod_dav_svn module did not properly validate the     svn:author property of certain requests. An attacker able to create new     revisions could use this flaw to spoof the svn:author property.
    (CVE-2015-0251)

    It was found that when an SVN server (both svnserve and httpd with the     mod_dav_svn module) searched the history of a file or a directory, it would     disclose its location in the repository if that file or directory was not     readable (for example, if it had been moved). (CVE-2015-3187)

    Red Hat would like to thank the Apache Software Foundation for reporting     these issues. Upstream acknowledges Evgeny Kotkov of VisualSVN as the     original reporter of CVE-2015-0248 and CVE-2015-0251, and C. Michael Pilato     of CollabNet as the original reporter of CVE-2015-3187.

    All subversion users should upgrade to these updated packages, which     contain backported patches to correct these issues. After installing the     updated packages, for the update to take effect, you must restart the httpd     daemon, if you are using mod_dav_svn, and the svnserve daemon, if you are     serving Subversion repositories via the svn:// protocol.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1633 advisory.

    [1.6.11-15]
    - add security fixes for CVE-2015-0248, CVE-2015-0251, CVE-2015-3187

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated subversion packages that fix three security issues are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. The mod_dav_svn module is used with the Apache HTTP Server to allow access to Subversion repositories via HTTP.

An assertion failure flaw was found in the way the SVN server processed certain requests with dynamically evaluated revision numbers. A remote attacker could use this flaw to cause the SVN server (both svnserve and httpd with the mod_dav_svn module) to crash.
(CVE-2015-0248)

It was found that the mod_dav_svn module did not properly validate the svn:author property of certain requests. An attacker able to create new revisions could use this flaw to spoof the svn:author property.
(CVE-2015-0251)

It was found that when an SVN server (both svnserve and httpd with the mod_dav_svn module) searched the history of a file or a directory, it would disclose its location in the repository if that file or directory was not readable (for example, if it had been moved).
(CVE-2015-3187)

Red Hat would like to thank the Apache Software Foundation for reporting these issues. Upstream acknowledges Evgeny Kotkov of VisualSVN as the original reporter of CVE-2015-0248 and CVE-2015-0251, and C. Michael Pilato of CollabNet as the original reporter of CVE-2015-3187.

All subversion users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, for the update to take effect, you must restart the httpd daemon, if you are using mod_dav_svn, and the svnserve daemon, if you are serving Subversion repositories via the svn:// protocol.

C. Michael Pilato, from CollabNet, reported an issue in the version control system Subversion.

CVE-2015-3187

Subversion servers revealed some sensible paths hidden by path-based authorization. Remote authenticated users were allowed to obtain path information by reading the history of a node that has been moved from a hidden path. The vulnerability only revealed the path, though it didn't reveal its content.

For Debian 6 'Squeeze', this issue has been fixed in subversion 1.6.12dfsg-7+deb6u3. We recommend to upgrade your subversion packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several security issues have been found in the server components of the version control system subversion.

  - CVE-2015-3184     Subversion's mod_authz_svn does not properly restrict     anonymous access in some mixed anonymous/authenticated     environments when using Apache httpd 2.4. The result is     that anonymous access may be possible to files for which     only authenticated access should be possible. This issue     does not affect the oldstable distribution (wheezy)     because it only contains Apache httpd 2.2.

  - CVE-2015-3187     Subversion servers, both httpd and svnserve, will reveal     some paths that should be hidden by path-based authz.
    When a node is copied from an unreadable location to a     readable location the unreadable path may be revealed.
    This vulnerablity only reveals the path, it does not     reveal the contents of the path.

Subversion reports :

CVE-2015-3184 : Subversion's mod_authz_svn does not properly restrict anonymous access in some mixed anonymous/authenticated environments when using Apache httpd 2.4.

CVE-2015-3187 : Subversion servers, both httpd and svnserve, will reveal some paths that should be hidden by path-based authz.

ID	Name	Product	Family	Severity
199213	RHEL 5 : subversion (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
93992	GLSA-201610-05 : Subversion, Serf: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
90269	Amazon Linux AMI : mod_dav_svn / subversion (ALAS-2016-676)	Nessus	Amazon Linux Local Security Checks	high
90148	Apple Xcode < 7.3 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	medium
87624	openSUSE Security Update : subversion (openSUSE-2015-949)	Nessus	SuSE Local Security Checks	high
86510	CentOS 7 : subversion (CESA-2015:1742)	Nessus	CentOS Local Security Checks	medium
8973	Apache Subversion 1.7.x < 1.7.21 / 1.8.x < 1.8.14 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
85978	RHEL 7 : subversion (RHSA-2015:1742)	Nessus	Red Hat Local Security Checks	medium
85867	Scientific Linux Security Update : subversion on SL7.x x86_64 (20150908)	Nessus	Scientific Linux Local Security Checks	medium
85865	Oracle Linux 7 : subversion (ELSA-2015-1742)	Nessus	Oracle Linux Local Security Checks	high
85579	Ubuntu 14.04 LTS : Subversion vulnerabilities (USN-2721-1)	Nessus	Ubuntu Local Security Checks	high
85524	openSUSE Security Update : subversion (openSUSE-2015-549)	Nessus	SuSE Local Security Checks	medium
85503	Scientific Linux Security Update : subversion on SL6.x i386/x86_64 (20150817)	Nessus	Scientific Linux Local Security Checks	medium
85494	RHEL 6 : subversion (RHSA-2015:1633)	Nessus	Red Hat Local Security Checks	high
85489	Oracle Linux 6 : subversion (ELSA-2015-1633)	Nessus	Oracle Linux Local Security Checks	high
85461	CentOS 6 : subversion (CESA-2015:1633)	Nessus	CentOS Local Security Checks	medium
85419	Debian DLA-293-1 : subversion security update	Nessus	Debian Local Security Checks	medium
85354	Debian DSA-3331-1 : subversion - security update	Nessus	Debian Local Security Checks	medium
85257	FreeBSD : subversion -- multiple vulnerabilities (57bb5e3d-3c4f-11e5-a4d4-001e8c75030d)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2015-3187

high

Tenable Plugins

critical

high

high

medium

high

medium

medium

medium

medium

high

high

medium

medium

high

high

medium

medium

medium

medium