A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server. The vulnerability affects all clients, including those that use file://, http://, and plain (untunneled) svn://.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - subversion: Command injection through clients via malicious svn+ssh URLs (CVE-2017-9800)

  - Svnserve in Apache Subversion 1.4.0 through 1.7.12 and 1.8.0 through 1.8.1 allows local users to overwrite     arbitrary files or kill arbitrary processes via a symlink attack on the file specified by the --pid-file     option. (CVE-2013-4277)

  - Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL     and authentication realm to store cached credentials, which makes it easier for remote servers to obtain     the credentials via a crafted authentication realm. (CVE-2014-3528)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - subversion: Command injection through clients via malicious svn+ssh URLs (CVE-2017-9800)

  - Svnserve in Apache Subversion 1.4.0 through 1.7.12 and 1.8.0 through 1.8.1 allows local users to overwrite     arbitrary files or kill arbitrary processes via a symlink attack on the file specified by the --pid-file     option. (CVE-2013-4277)

  - The canonicalize_username function in svnserve/cyrus_auth.c in Apache Subversion before 1.8.16 and 1.9.x     before 1.9.4, when Cyrus SASL authentication is used, allows remote attackers to authenticate and bypass     intended access restrictions via a realm string that is a prefix of an expected repository realm string.
    (CVE-2016-2167)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

An update of the subversion package has been released.

The version of Apple Xcode installed on the remote macOS or Mac OS X host is prior to 9.0. It is, therefore, affected by multiple remote code execution vulnerabilities in the git, Id64, and subversion components. An unauthenticated, remote attacker can exploit these vulnerabilities to cause execution of arbitrary code.

The remote host is affected by the vulnerability described in GLSA-201709-09 (Subversion: Arbitrary code execution)

    Specially crafted &lsquo;ssh://...&rsquo; URLs may allow the owner of the       repository to execute arbitrary commands on client&rsquo;s machine if those       commands are already installed on the client&rsquo;s system. This is       especially dangerous when the third-party repository has one or more       submodules with specially crafted &lsquo;ssh://...&rsquo; URLs. Each time the       repository is recursively cloned or submodules are updated the payload       will be triggered.
  Impact :

    A remote attacker, by enticing a user to clone a specially crafted       repository, could possibly execute arbitrary code with the privileges of       the process.
  Workaround :

    There are several alternative ways to fix this vulnerability. Please       refer to Subversion Team Announce for more details.

According to the version of the subversion packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A shell command injection flaw related to the handling     of 'svn+ssh' URLs has been discovered in Subversion. An     attacker could use this flaw to execute shell commands     with the privileges of the user running the Subversion     client, for example when performing a 'checkout' or     'update' action on a malicious repository, or a     legitimate repository containing a malicious commit.
    (CVE-2017-9800)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Command injection through clients via malicious svn+ssh URLs

A shell command injection flaw related to the handling of 'svn+ssh' URLs has been discovered in Subversion. An attacker could use this flaw to execute shell commands with the privileges of the user running the Subversion client, for example when performing a 'checkout' or 'update' action on a malicious repository, or a legitimate repository containing a malicious commit. (CVE-2017-9800)

An update for subversion is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes.

Security Fix(es) :

* A shell command injection flaw related to the handling of 'svn+ssh' URLs has been discovered in Subversion. An attacker could use this flaw to execute shell commands with the privileges of the user running the Subversion client, for example when performing a 'checkout' or 'update' action on a malicious repository, or a legitimate repository containing a malicious commit. (CVE-2017-9800)

Red Hat would like to thank the Subversion Team for reporting this issue.

This update includes the latest stable release of _Apache Subversion_, version **1.9.7**.

#### Client-side bugfixes :

  - Fix arbitrary code execution vulnerability CVE-2017-9800     See     <https://subversion.apache.org/security/CVE-2017-9800-ad     visory.txt> for details.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - A shell command injection flaw related to the handling     of 'svn+ssh' URLs has been discovered in Subversion. An     attacker could use this flaw to execute shell commands     with the privileges of the user running the Subversion     client, for example when performing a 'checkout' or     'update' action on a malicious repository, or a     legitimate repository containing a malicious commit.
    (CVE-2017-9800)

This update for subversion to 1.9.7 fixes security issues and bugs.

The following vulnerabilities were fixed :

  - CVE-2017-9800: A remote attacker could have caused svn     clients to execute arbitrary code via specially crafted     URLs in svn:externals and svn:sync-from-url properties.
    (boo#1051362)

  - CVE-2005-4900: SHA-1 collisions may cause repository     inconsistencies (boo#1026936)

The following bugfix changes are included :

  - Add instructions for running svnserve as a user     different from 'svn', and remove sysconfig variables     that are no longer effective with the systemd unit.
    (boo#1049448)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:2480 advisory.

    Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in     developing and maintaining a hierarchy of files and directories while keeping a history of all changes.

    Security Fix(es):

    * A shell command injection flaw related to the handling of svn+ssh URLs has been discovered in     Subversion. An attacker could use this flaw to execute shell commands with the privileges of the user     running the Subversion client, for example when performing a checkout or update action on a malicious     repository, or a legitimate repository containing a malicious commit. (CVE-2017-9800)

    Red Hat would like to thank the Subversion Team for reporting this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-2480 advisory.

    [1.7.14-11]
    - add security fix for CVE-2017-9800

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that there was a arbitrary code execution vulnerability in the subversion revision control system via malicious 'svn+ssh' URLs in 'svn:externals' and 'svn:sync-from-url'.

For Debian 7 'Wheezy', this issue has been fixed in subversion version 1.6.17dfsg-4+deb7u12.

We recommend that you upgrade your subversion packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New subversion packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3388-1 advisory.

    Joern Schneeweisz discovered that Subversion did not properly handle host names in 'svn+ssh://' URLs. A     remote attacker could use this to construct a subversion repository that when accessed could run arbitrary     code with the privileges of the user. (CVE-2017-9800)

    Daniel Shahaf and James McCoy discovered that Subversion did not properly verify realms when using Cyrus     SASL authentication. A remote attacker could use this to possibly bypass intended access restrictions.
    This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-2167)

    Florian Weimer discovered that Subversion clients did not properly restrict XML entity expansion when     accessing http(s):// URLs. A remote attacker could use this to cause a denial of service. This issue only     affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-8734)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several problems were discovered in Subversion, a centralised version control system.

  - CVE-2016-8734     (jessie only)

  Subversion's mod_dontdothat server module and Subversion clients   using http(s):// were vulnerable to a denial-of-service attack   caused by exponential XML entity expansion.

  - CVE-2017-9800     Joern Schneeweisz discovered that Subversion did not     correctly handle maliciously constructed svn+ssh://     URLs. This allowed an attacker to run an arbitrary shell     command, for instance via svn:externals properties or     when using 'svnsync sync'.

ID	Name	Product	Family	Severity
199213	RHEL 5 : subversion (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199158	RHEL 6 : subversion (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196468	RHEL 6 : subversion (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
196464	RHEL 5 : subversion (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
121728	Photon OS 1.0: Subversion PHSA-2017-0031	Nessus	PhotonOS Local Security Checks	critical
103359	Apple Xcode < 9.0 Multiple RCE (macOS)	Nessus	MacOS X Local Security Checks	critical
103277	GLSA-201709-09 : Subversion: Arbitrary code execution	Nessus	Gentoo Local Security Checks	critical
103014	EulerOS 2.0 SP2 : subversion (EulerOS-SA-2017-1176)	Nessus	Huawei Local Security Checks	critical
103013	EulerOS 2.0 SP1 : subversion (EulerOS-SA-2017-1175)	Nessus	Huawei Local Security Checks	critical
102871	Amazon Linux AMI : subversion / mod_dav_svn (ALAS-2017-883)	Nessus	Amazon Linux Local Security Checks	critical
102768	CentOS 7 : subversion (CESA-2017:2480)	Nessus	CentOS Local Security Checks	critical
102716	Fedora 25 : subversion (2017-1d1a38bdd1)	Nessus	Fedora Local Security Checks	critical
102673	Scientific Linux Security Update : subversion on SL7.x x86_64 (20170816)	Nessus	Scientific Linux Local Security Checks	critical
102559	openSUSE Security Update : subversion (openSUSE-2017-940)	Nessus	SuSE Local Security Checks	critical
102520	RHEL 7 : subversion (RHSA-2017:2480)	Nessus	Red Hat Local Security Checks	critical
102516	Oracle Linux 7 : subversion (ELSA-2017-2480)	Nessus	Oracle Linux Local Security Checks	critical
102486	Fedora 26 : subversion (2017-951b6a78d4)	Nessus	Fedora Local Security Checks	critical
102437	Debian DLA-1052-1 : subversion security update	Nessus	Debian Local Security Checks	critical
102435	Slackware 14.0 / 14.1 / 14.2 / current : subversion (SSA:2017-223-04)	Nessus	Slackware Local Security Checks	critical
102424	Ubuntu 14.04 LTS / 16.04 LTS : Subversion vulnerabilities (USN-3388-1)	Nessus	Ubuntu Local Security Checks	critical
102372	Debian DSA-3932-1 : subversion - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2017-9800

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical