GLSA-200409-35 : Subversion: Metadata information leak

medium Nessus Plugin ID 15406

Synopsis

The remote Gentoo host is missing one or more security-related patches.

Description

The remote host is affected by the vulnerability described in GLSA-200409-35 (Subversion: Metadata information leak)

There is a bug in mod_authz_svn that causes it to reveal logged metadata regarding commits to protected areas.
Impact :

Protected files themselves will not be revealed, but an attacker could use the metadata to reveal the existence of protected areas, such as paths, file versions, and the commit logs from those areas.
Workaround :

Rather than using mod_authz_svn, move protected areas into separate repositories and use native Apache authentication to make these repositories unreadable.

Solution

All Subversion users should upgrade to the latest version:
# emerge sync # emerge -pv '>=dev-util/subversion-1.0.8' # emerge '>=dev-util/subversion-1.0.8'

Plugin Details

Severity: Medium

ID: 15406

File Name: gentoo_GLSA-200409-35.nasl

Version: 1.18

Type: local

Family: Gentoo Local Security Checks

Published: 10/1/2004

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Information

CPE: p-cpe:/a:gentoo:linux:subversion, cpe:/o:gentoo:linux

Required KB Items: Host/local_checks_enabled, Host/Gentoo/release, Host/Gentoo/qpkg-list

Patch Publication Date: 9/29/2004

Vulnerability Publication Date: 9/23/2004

Reference Information

CVE: CVE-2004-0749

GLSA: 200409-35

Detections

Analytics