Apache Subversion's mod_dontdothat module and HTTP clients 1.4.0 through 1.8.16, and 1.9.0 through 1.9.4 are vulnerable to a denial-of-service attack caused by exponential XML entity expansion. The attack can cause the targeted process to consume an excessive amount of CPU resources or memory.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - subversion: (mod_dav_svn) integer overflow when parsing skel-encoded request bodies (CVE-2015-5343)

  - The canonicalize_username function in svnserve/cyrus_auth.c in Apache Subversion before 1.8.16 and 1.9.x     before 1.9.4, when Cyrus SASL authentication is used, allows remote attackers to authenticate and bypass     intended access restrictions via a realm string that is a prefix of an expected repository realm string.
    (CVE-2016-2167)

  - The req_check_access function in the mod_authz_svn module in the httpd server in Apache Subversion before     1.8.16 and 1.9.x before 1.9.4 allows remote authenticated users to cause a denial of service (NULL pointer     dereference and crash) via a crafted header in a (1) MOVE or (2) COPY request, involving an authorization     check. (CVE-2016-2168)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the subversion packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Apache Subversion's mod_dontdothat module and HTTP     clients 1.4.0 through 1.8.16, and 1.9.0 through 1.9.4     are vulnerable to a denial-of-service attack caused by     exponential XML entity expansion. The attack can cause     the targeted process to consume an excessive amount of     CPU resources or memory.(CVE-2016-8734)

  - Integer overflow in util.c in mod_dav_svn in Apache     Subversion 1.7.x, 1.8.x before 1.8.15, and 1.9.x before     1.9.3 allows remote authenticated users to cause a     denial of service (subversion server crash or memory     consumption) and possibly execute arbitrary code via a     skel-encoded request body, which triggers an     out-of-bounds read and heap-based buffer     overflow.(CVE-2015-5343)

  - The canonicalize_username function in     svnserve/cyrus_auth.c in Apache Subversion before     1.8.16 and 1.9.x before 1.9.4, when Cyrus SASL     authentication is used, allows remote attackers to     authenticate and bypass intended access restrictions     via a realm string that is a prefix of an expected     repository realm string.(CVE-2016-2167)

  - The req_check_access function in the mod_authz_svn     module in the httpd server in Apache Subversion before     1.8.16 and 1.9.x before 1.9.4 allows remote     authenticated users to cause a denial of service (NULL     pointer dereference and crash) via a crafted header in     a (1) MOVE or (2) COPY request, involving an     authorization check.(CVE-2016-2168)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the subversion packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Integer overflow in util.c in mod_dav_svn in Apache     Subversion 1.7.x, 1.8.x before 1.8.15, and 1.9.x before     1.9.3 allows remote authenticated users to cause a     denial of service (subversion server crash or memory     consumption) and possibly execute arbitrary code via a     skel-encoded request body, which triggers an     out-of-bounds read and heap-based buffer     overflow.(CVE-2015-5343)

  - The canonicalize_username function in     svnserve/cyrus_auth.c in Apache Subversion before     1.8.16 and 1.9.x before 1.9.4, when Cyrus SASL     authentication is used, allows remote attackers to     authenticate and bypass intended access restrictions     via a realm string that is a prefix of an expected     repository realm string.(CVE-2016-2167)

  - The req_check_access function in the mod_authz_svn     module in the httpd server in Apache Subversion before     1.8.16 and 1.9.x before 1.9.4 allows remote     authenticated users to cause a denial of service (NULL     pointer dereference and crash) via a crafted header in     a (1) MOVE or (2) COPY request, involving an     authorization check.(CVE-2016-2168)

  - Apache Subversion's mod_dontdothat module and HTTP     clients 1.4.0 through 1.8.16, and 1.9.0 through 1.9.4     are vulnerable to a denial-of-service attack caused by     exponential XML entity expansion. The attack can cause     the targeted process to consume an excessive amount of     CPU resources or memory.(CVE-2016-8734)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the subversion package has been released.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3388-1 advisory.

    Joern Schneeweisz discovered that Subversion did not properly handle host names in 'svn+ssh://' URLs. A     remote attacker could use this to construct a subversion repository that when accessed could run arbitrary     code with the privileges of the user. (CVE-2017-9800)

    Daniel Shahaf and James McCoy discovered that Subversion did not properly verify realms when using Cyrus     SASL authentication. A remote attacker could use this to possibly bypass intended access restrictions.
    This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-2167)

    Florian Weimer discovered that Subversion clients did not properly restrict XML entity expansion when     accessing http(s):// URLs. A remote attacker could use this to cause a denial of service. This issue only     affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-8734)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several problems were discovered in Subversion, a centralised version control system.

  - CVE-2016-8734     (jessie only)

  Subversion's mod_dontdothat server module and Subversion clients   using http(s):// were vulnerable to a denial-of-service attack   caused by exponential XML entity expansion.

  - CVE-2017-9800     Joern Schneeweisz discovered that Subversion did not     correctly handle maliciously constructed svn+ssh://     URLs. This allowed an attacker to run an arbitrary shell     command, for instance via svn:externals properties or     when using 'svnsync sync'.

It was discovered that Subversion's mod_dontdothat module and Subversion clients using http(s):// are vulnerable to a denial-of-service attack caused by exponential XML entity expansion.
An authenticated remote attacker can cause denial-of-service conditions on the server using mod_dontdothat by sending a specially crafted REPORT request. The attack does not require access to a particular repository.

The version of Apache Subversion installed on the remote host is version 1.8.x prior to 1.8.17 or 1.9.x prior to 1.9.5. It is, therefore, affected by an XXE (Xml eXternal Entity) injection flaw in the 'mod_dontdothat' module in 'libsvn_ra_serf/xml.c' that is triggered during the parsing of XML data. The issue is due to an incorrectly configured XML parser accepting XML external entities from an untrusted source. By sending specially crafted XML data, a remote attacker can exhaust available resources.

This update includes the latest stable release of _Apache Subversion_, version **1.9.5**.

#### Client-side bugfixes :

  - fix accessing non-existent paths during reintegrate     merge 

  - fix handling of newly secured subdirectories in working     copy 

  - info: remove trailing whitespace in --show-item=revision     ([issue     4660](http://subversion.tigris.org/issues/show_bug.cgi?i     d=4660))

  - fix recording wrong revisions for tree conflicts 

  - gpg-agent: improve discovery of gpg-agent sockets 

  - gpg-agent: fix file descriptor leak 

  - resolve: fix --accept=mine-full for binary files ([issue     4647](http://subversion.tigris.org/issues/show_bug.cgi?i     d=4647))

  - merge: fix possible crash ([issue     4652](http://subversion.tigris.org/issues/show_bug.cgi?i     d=4652))

  - resolve: fix possible crash 

  - fix potential crash in Win32 crash reporter ####     Server-side bugfixes :

  - fsfs: fix 'offset too large' error during pack ([issue     4657](http://subversion.tigris.org/issues/show_bug.cgi?i     d=4657))

  - svnserve: enable hook script environments 

  - fsfs: fix possible data reconstruction error ([issue     4658](http://subversion.tigris.org/issues/show_bug.cgi?i     d=4658))

  - fix source of spurious 'incoming edit' tree conflicts 

  - fsfs: improve caching for large directories 

  - fsfs: fix crash when encountering all-zero checksums 

  - fsfs: fix potential source of repository corruptions 

  - mod_dav_svn: fix excessive memory usage with     mod_headers/mod_deflate ([issue     3084](http://subversion.tigris.org/issues/show_bug.cgi?i     d=3084))

  - mod_dav_svn: reduce memory usage during GET requests 

  - fsfs: fix unexpected 'database is locked' errors 

  - fsfs: fix opening old repositories without db/format     files #### Client-side and server-side bugfixes :

  - fix possible crash when reading invalid configuration     files #### Bindings bugfixes :

  - swig-pl: do not corrupt '{DATE}' revision variable 

  - javahl: fix temporary accepting SSL server certificates 

  - swig-pl: fix possible stack corruption

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for subversion fixes the following issues :

  - Version update to 1.9.5 :

  - Unrestricted XML entity expansion in mod_dontdothat and     Subversion clients using http(s):// (boo#1011552,     CVE-2016-8734)

  - Client-side bugfixes :

  - fix accessing non-existent paths during reintegrate     merge (r1766699 et al)

  - fix handling of newly secured subdirectories in working     copy (r1724448)

  - info: remove trailing whitespace in --show-item=revision     (issue #4660)

  - fix recording wrong revisions for tree conflicts     (r1734106)

  - gpg-agent: improve discovery of gpg-agent sockets     (r1766327)

  - gpg-agent: fix file descriptor leak (r1766323)

  - resolve: fix --accept=mine-full for binary files (issue     #4647)

  - merge: fix possible crash (issue #4652)

  - resolve: fix possible crash (r1748514)

  - fix potential crash in Win32 crash reporter (r1663253 et     al)

  - Server-side bugfixes :

  - fsfs: fix 'offset too large' error during pack (issue     #4657)

  - svnserve: enable hook script environments (r1769152)

  - fsfs: fix possible data reconstruction error (issue     #4658)

  - fix source of spurious 'incoming edit' tree conflicts     (r1770108)

  - fsfs: improve caching for large directories (r1721285)

  - fsfs: fix crash when encountering all-zero checksums     (r1759686)

  - fsfs: fix potential source of repository corruptions     (r1756266)

  - mod_dav_svn: fix excessive memory usage with     mod_headers/mod_deflate (issue #3084)

  - mod_dav_svn: reduce memory usage during GET requests     (r1757529 et al)

  - fsfs: fix unexpected 'database is locked' errors     (r1741096 et al)

  - fsfs: fix opening old repositories without db/format     files (r1720015)

  - Client-side and server-side bugfixes :

  - fix possible crash when reading invalid configuration     files (r1715777)

  - Bindings bugfixes :

  - swig-pl: do not corrupt '(DATE)' revision variable     (r1767768)

  - javahl: fix temporary accepting SSL server certificates     (r1764851)

  - swig-pl: fix possible stack corruption (r1683266,     r1683267)

The Apache Software Foundation reports :

The mod_dontdothat module of subversion and subversion clients using http(s):// are vulnerable to a denial-of-service attack, caused by exponential XML entity expansion. The attack targets XML parsers causing targeted process to consume excessive amounts of resources.
The attack is also known as the 'billions of laughs attack.'

ID	Name	Product	Family	Severity
199170	RHEL 7 : subversion (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
132204	EulerOS 2.0 SP3 : subversion (EulerOS-SA-2019-2669)	Nessus	Huawei Local Security Checks	high
131824	EulerOS 2.0 SP5 : subversion (EulerOS-SA-2019-2550)	Nessus	Huawei Local Security Checks	high
131657	EulerOS 2.0 SP2 : subversion (EulerOS-SA-2019-2504)	Nessus	Huawei Local Security Checks	high
121782	Photon OS 1.0: Subversion PHSA-2017-1.0-0093	Nessus	PhotonOS Local Security Checks	medium
102424	Ubuntu 14.04 LTS / 16.04 LTS : Subversion vulnerabilities (USN-3388-1)	Nessus	Ubuntu Local Security Checks	critical
102372	Debian DSA-3932-1 : subversion - security update	Nessus	Debian Local Security Checks	critical
97024	Amazon Linux AMI : subversion / mod_dav_svn (ALAS-2017-794)	Nessus	Amazon Linux Local Security Checks	medium
9907	Apache Subversion 1.8.x < 1.8.17 / 1.9.x < 1.9.5 DoS	Nessus Network Monitor	Web Servers	medium
96360	Fedora 25 : subversion (2017-c629f16f6c)	Nessus	Fedora Local Security Checks	medium
95707	openSUSE Security Update : subversion (openSUSE-2016-1435)	Nessus	SuSE Local Security Checks	medium
95409	FreeBSD : subversion -- Unrestricted XML entity expansion in mod_dontdothat and Subversionclients using http(s) (ac256985-b6a9-11e6-a3bf-206a8a720317)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2016-8734

medium

Tenable Plugins

high

high

high

high

medium

critical

critical

medium

medium

medium

medium

medium