The canonicalize_username function in svnserve/cyrus_auth.c in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4, when Cyrus SASL authentication is used, allows remote attackers to authenticate and bypass intended access restrictions via a realm string that is a prefix of an expected repository realm string.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - subversion: Command injection through clients via malicious svn+ssh URLs (CVE-2017-9800)

  - Svnserve in Apache Subversion 1.4.0 through 1.7.12 and 1.8.0 through 1.8.1 allows local users to overwrite     arbitrary files or kill arbitrary processes via a symlink attack on the file specified by the --pid-file     option. (CVE-2013-4277)

  - Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL     and authentication realm to store cached credentials, which makes it easier for remote servers to obtain     the credentials via a crafted authentication realm. (CVE-2014-3528)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - subversion: (mod_dav_svn) integer overflow when parsing skel-encoded request bodies (CVE-2015-5343)

  - The canonicalize_username function in svnserve/cyrus_auth.c in Apache Subversion before 1.8.16 and 1.9.x     before 1.9.4, when Cyrus SASL authentication is used, allows remote attackers to authenticate and bypass     intended access restrictions via a realm string that is a prefix of an expected repository realm string.
    (CVE-2016-2167)

  - The req_check_access function in the mod_authz_svn module in the httpd server in Apache Subversion before     1.8.16 and 1.9.x before 1.9.4 allows remote authenticated users to cause a denial of service (NULL pointer     dereference and crash) via a crafted header in a (1) MOVE or (2) COPY request, involving an authorization     check. (CVE-2016-2168)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - subversion: Command injection through clients via malicious svn+ssh URLs (CVE-2017-9800)

  - Svnserve in Apache Subversion 1.4.0 through 1.7.12 and 1.8.0 through 1.8.1 allows local users to overwrite     arbitrary files or kill arbitrary processes via a symlink attack on the file specified by the --pid-file     option. (CVE-2013-4277)

  - The canonicalize_username function in svnserve/cyrus_auth.c in Apache Subversion before 1.8.16 and 1.9.x     before 1.9.4, when Cyrus SASL authentication is used, allows remote attackers to authenticate and bypass     intended access restrictions via a realm string that is a prefix of an expected repository realm string.
    (CVE-2016-2167)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the subversion packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Apache Subversion's mod_dontdothat module and HTTP     clients 1.4.0 through 1.8.16, and 1.9.0 through 1.9.4     are vulnerable to a denial-of-service attack caused by     exponential XML entity expansion. The attack can cause     the targeted process to consume an excessive amount of     CPU resources or memory.(CVE-2016-8734)

  - Integer overflow in util.c in mod_dav_svn in Apache     Subversion 1.7.x, 1.8.x before 1.8.15, and 1.9.x before     1.9.3 allows remote authenticated users to cause a     denial of service (subversion server crash or memory     consumption) and possibly execute arbitrary code via a     skel-encoded request body, which triggers an     out-of-bounds read and heap-based buffer     overflow.(CVE-2015-5343)

  - The canonicalize_username function in     svnserve/cyrus_auth.c in Apache Subversion before     1.8.16 and 1.9.x before 1.9.4, when Cyrus SASL     authentication is used, allows remote attackers to     authenticate and bypass intended access restrictions     via a realm string that is a prefix of an expected     repository realm string.(CVE-2016-2167)

  - The req_check_access function in the mod_authz_svn     module in the httpd server in Apache Subversion before     1.8.16 and 1.9.x before 1.9.4 allows remote     authenticated users to cause a denial of service (NULL     pointer dereference and crash) via a crafted header in     a (1) MOVE or (2) COPY request, involving an     authorization check.(CVE-2016-2168)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the subversion packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Integer overflow in util.c in mod_dav_svn in Apache     Subversion 1.7.x, 1.8.x before 1.8.15, and 1.9.x before     1.9.3 allows remote authenticated users to cause a     denial of service (subversion server crash or memory     consumption) and possibly execute arbitrary code via a     skel-encoded request body, which triggers an     out-of-bounds read and heap-based buffer     overflow.(CVE-2015-5343)

  - The canonicalize_username function in     svnserve/cyrus_auth.c in Apache Subversion before     1.8.16 and 1.9.x before 1.9.4, when Cyrus SASL     authentication is used, allows remote attackers to     authenticate and bypass intended access restrictions     via a realm string that is a prefix of an expected     repository realm string.(CVE-2016-2167)

  - The req_check_access function in the mod_authz_svn     module in the httpd server in Apache Subversion before     1.8.16 and 1.9.x before 1.9.4 allows remote     authenticated users to cause a denial of service (NULL     pointer dereference and crash) via a crafted header in     a (1) MOVE or (2) COPY request, involving an     authorization check.(CVE-2016-2168)

  - Apache Subversion's mod_dontdothat module and HTTP     clients 1.4.0 through 1.8.16, and 1.9.0 through 1.9.4     are vulnerable to a denial-of-service attack caused by     exponential XML entity expansion. The attack can cause     the targeted process to consume an excessive amount of     CPU resources or memory.(CVE-2016-8734)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the subversion package has been released.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3388-1 advisory.

    Joern Schneeweisz discovered that Subversion did not properly handle host names in 'svn+ssh://' URLs. A     remote attacker could use this to construct a subversion repository that when accessed could run arbitrary     code with the privileges of the user. (CVE-2017-9800)

    Daniel Shahaf and James McCoy discovered that Subversion did not properly verify realms when using Cyrus     SASL authentication. A remote attacker could use this to possibly bypass intended access restrictions.
    This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-2167)

    Florian Weimer discovered that Subversion clients did not properly restrict XML entity expansion when     accessing http(s):// URLs. A remote attacker could use this to cause a denial of service. This issue only     affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-8734)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201610-05 (Subversion, Serf: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Subversion and Serf.
      Please review the CVE identifiers referenced below for details   Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, conduct a man-in-the-middle attack, obtain       sensitive information, or cause a Denial of Service Condition.
  Workaround :

    There is no known workaround at this time.

- Update to 1.9.4 (#1331222) CVE-2016-2167 CVE-2016-2168

  - Move tools in docs to tools subpackage (rhbz 1171757     1199761)

  - Disable make check to work around FTBFS

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The canonicalize_username function in svnserve/cyrus_auth.c in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4, when Cyrus SASL authentication is used, allows remote attackers to authenticate and bypass intended access restrictions via a realm string that is a prefix of an expected repository realm string. (CVE-2016-2167)

The req_check_access function in the mod_authz_svn module in the httpd server in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a crafted header in a (1) MOVE or (2) COPY request, involving an authorization check. (CVE-2016-2168)

- Update to 1.9.4 (#1331222) CVE-2016-2167 CVE-2016-2168 -     Move tools in docs to tools subpackage (rhbz 1171757     1199761) - Disable make check to work around FTBFS

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for subversion fixes the following issues :

  - CVE-2016-2167: mod_authz_svn: DoS in MOVE/COPY     authorization check (bsc#976849)

  - CVE-2016-2168: svnserve/sasl may authenticate users     using the wrong realm (bsc#976850)

The following non-security bugs were fixed :

  - mod_authz_svn: fix authz with     mod_auth_kerb/mod_auth_ntlm (boo#977424)

This update for subversion fixes the following issues :

  - CVE-2016-2167: mod_authz_svn: DoS in MOVE/COPY     authorization check (bsc#976849)

  - CVE-2016-2168: svnserve/sasl may authenticate users     using the wrong realm (bsc#976850)

The following non-security bugs were fixed :

  - bsc#969159: subversion dependencies did not enforce     matching password store

  - bsc#911620: svnserve could not be started via YaST     Service manager

This update was imported from the SUSE:SLE-12:Update update project.

Several vulnerabilities were discovered in Subversion, a version control system. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2016-2167     Daniel Shahaf and James McCoy discovered that an     implementation error in the authentication against the     Cyrus SASL library would permit a remote user to specify     a realm string which is a prefix of the expected realm     string and potentially allowing a user to authenticate     using the wrong realm.

  - CVE-2016-2168     Ivan Zhakov of VisualSVN discovered a remotely     triggerable denial of service vulnerability in the     mod_authz_svn module during COPY or MOVE authorization     check. An authenticated remote attacker could take     advantage of this flaw to cause a denial of service     (Subversion server crash) via COPY or MOVE requests with     specially crafted header.

CVE-2016-2167

svnserve, the svn:// protocol server, can optionally use the Cyrus SASL library for authentication, integrity protection, and encryption.
Due to a programming oversight, authentication against Cyrus SASL would permit the remote user to specify a realm string which is a prefix of the expected realm string.

CVE-2016-2168

Subversion's httpd servers are vulnerable to a remotely triggerable crash in the mod_authz_svn module. The crash can occur during an authorization check for a COPY or MOVE request with a specially crafted header value.

This allows remote attackers to cause a denial of service.

-- James GPG Key: 4096R/331BA3DB 2011-12-05 James McCoy <jamessan@debian.org>

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New subversion packages are available for Slackware 14.0, 14.1, and
-current to fix security issues.

Subversion project reports :

svnserve, the svn:// protocol server, can optionally use the Cyrus SASL library for authentication, integrity protection, and encryption.
Due to a programming oversight, authentication against Cyrus SASL would permit the remote user to specify a realm string which is a prefix of the expected realm string.

Subversion's httpd servers are vulnerable to a remotely triggerable crash in the mod_authz_svn module. The crash can occur during an authorization check for a COPY or MOVE request with a specially crafted header value.

This allows remote attackers to cause a denial of service.

The version of Apache Subversion installed on the remote host is version 1.8.x prior to 1.8.16 or 1.9.x prior to 1.9.4. It is, therefore, affected by the following vulnerabilities : 

 - A flaw exists within 'svnserve/sasl' that is triggered when handling a realm string which is a prefix of the expected realm string, which can cause an authenticated remote attacker to incorrectly authenticate into the wrong realm. This may allow the attacker to gain access to areas they would otherwise be restricted from. (CVE-2016-2167)
 - A flaw exists within 'mod_authz_svn' that is triggered as authorization checks are not properly performed on 'COPY' and 'MOVE' actions. This may allow a remote attacker to use a specially crafted header to crash the server. (CVE-2016-2168)
 - A 'NULL pointer' dereference flaw exists within the 'mod_authz_svn' module that is triggered when handling invalid headers for COPY and MOVE requests. This may allow a remote attacker to cause a Subversion server to crash. (CVE-2016-2168)

ID	Name	Product	Family	Severity
199213	RHEL 5 : subversion (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199170	RHEL 7 : subversion (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199158	RHEL 6 : subversion (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
132204	EulerOS 2.0 SP3 : subversion (EulerOS-SA-2019-2669)	Nessus	Huawei Local Security Checks	high
131824	EulerOS 2.0 SP5 : subversion (EulerOS-SA-2019-2550)	Nessus	Huawei Local Security Checks	high
131657	EulerOS 2.0 SP2 : subversion (EulerOS-SA-2019-2504)	Nessus	Huawei Local Security Checks	high
121656	Photon OS 1.0: Subversion PHSA-2016-0013	Nessus	PhotonOS Local Security Checks	medium
102424	Ubuntu 14.04 LTS / 16.04 LTS : Subversion vulnerabilities (USN-3388-1)	Nessus	Ubuntu Local Security Checks	critical
93992	GLSA-201610-05 : Subversion, Serf: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
92183	Fedora 23 : subversion (2016-e024b3e02b)	Nessus	Fedora Local Security Checks	medium
91469	Amazon Linux AMI : mod_dav_svn (ALAS-2016-710)	Nessus	Amazon Linux Local Security Checks	medium
91468	Amazon Linux AMI : subversion (ALAS-2016-709)	Nessus	Amazon Linux Local Security Checks	medium
91059	Fedora 24 : subversion-1.9.4-1.fc24 (2016-20cc04ac50)	Nessus	Fedora Local Security Checks	medium
90983	openSUSE Security Update : subversion (openSUSE-2016-571)	Nessus	SuSE Local Security Checks	medium
90982	openSUSE Security Update : subversion (openSUSE-2016-570)	Nessus	SuSE Local Security Checks	medium
90808	Debian DSA-3561-1 : subversion - security update	Nessus	Debian Local Security Checks	medium
90805	Debian DLA-448-1 : subversion security update	Nessus	Debian Local Security Checks	medium
90802	Slackware 14.0 / 14.1 / current : subversion (SSA:2016-121-01)	Nessus	Slackware Local Security Checks	medium
90780	FreeBSD : subversion -- multiple vulnerabilities (c8174b63-0d3a-11e6-b06e-d43d7eed0ce2)	Nessus	FreeBSD Local Security Checks	medium
9395	Apache Subversion 1.8.x < 1.8.16 / 1.9.x < 1.9.4 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium

Detections

Analytics

CVE-2016-2167

medium

Tenable Plugins

critical

high

critical

high

high

high

medium

critical

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium