FreeBSD : Subversion -- multiple vulnerabilities (e27a1af3-8d21-11e0-a45d-001e8c75030d)

medium Nessus Plugin ID 54952

Synopsis

The remote FreeBSD host is missing one or more security-related updates.

Description

Subversion team reports :

Subversion's mod_dav_svn Apache HTTPD server module will dereference a NULL pointer if asked to deliver baselined WebDAV resources.

This can lead to a DoS. An exploit has been tested, and tools or users have been observed triggering this problem in the wild.

Subversion's mod_dav_svn Apache HTTPD server module may in certain scenarios enter a logic loop which does not exit and which allocates memory in each iteration, ultimately exhausting all the available memory on the server.

This can lead to a DoS. There are no known instances of this problem being observed in the wild, but an exploit has been tested.

Subversion's mod_dav_svn Apache HTTPD server module may leak to remote users the file contents of files configured to be unreadable by those users.

There are no known instances of this problem being observed in the wild, but an exploit has been tested.

Solution

Update the affected packages.

See Also

http://www.nessus.org/u?92960a5d

Plugin Details

Severity: Medium

ID: 54952

File Name: freebsd_pkg_e27a1af38d2111e0a45d001e8c75030d.nasl

Version: 1.10

Type: local

Published: 6/3/2011

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:subversion, p-cpe:/a:freebsd:freebsd:subversion-freebsd, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 6/2/2011

Vulnerability Publication Date: 5/28/2011

Reference Information

CVE: CVE-2011-1752, CVE-2011-1783, CVE-2011-1921