Scientific Linux Security Update : subversion on SL5.x i386/x86_64

medium Nessus Plugin ID 60954

Language:

Synopsis

The remote Scientific Linux host is missing one or more security updates.

Description

A server-side memory leak was found in the Subversion server. If a malicious, remote user performed 'svn blame' or 'svn log' operations on certain repository files, it could cause the Subversion server to consume a large amount of system memory. (CVE-2010-4644)

A NULL pointer dereference flaw was found in the way the mod_dav_svn module (for use with the Apache HTTP Server) processed certain requests. If a malicious, remote user issued a certain type of request to display a collection of Subversion repositories on a host that has the SVNListParentPath directive enabled, it could cause the httpd process serving the request to crash. Note that SVNListParentPath is not enabled by default. (CVE-2010-4539)

After installing the updated packages, the Subversion server must be restarted for the update to take effect: restart httpd if you are using mod_dav_svn, or restart svnserve if it is used.

Solution

Update the affected packages.

Plugin Details

Severity: Medium

ID: 60954

File Name: sl_20110215_subversion_on_SL5_x.nasl

Version: 1.5

Type: local

Agent: unix

Family: Scientific Linux Local Security Checks

Published: 8/1/2012

Updated: 1/14/2021

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C

Vulnerability Information

CPE: x-cpe:/o:fermilab:scientific_linux

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/RedHat/release, Host/RedHat/rpm-list

Patch Publication Date: 2/15/2011

Reference Information

CVE: CVE-2010-4539, CVE-2010-4644

Detections

Analytics