Detections
Analytics
RHEL 5 / 6 : subversion (RHSA-2014:0255)
high Nessus Plugin ID 72854
Language:
Synopsis
The remote Red Hat host is missing one or more security updates.Description
Updated subversion packages that fix three security issues are now available for Red Hat Enterprise Linux 5 and 6.The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. The mod_dav_svn module is used with the Apache HTTP Server to allow access to Subversion repositories via HTTP.
A flaw was found in the way the mod_dav_svn module handled OPTIONS requests. A remote attacker with read access to an SVN repository served via HTTP could use this flaw to cause the httpd process that handled such a request to crash. (CVE-2014-0032)
A flaw was found in the way Subversion handled file names with newline characters when the FSFS repository format was used. An attacker with commit access to an SVN repository could corrupt a revision by committing a specially crafted file. (CVE-2013-1968)
A flaw was found in the way the svnserve tool of Subversion handled remote client network connections. An attacker with read access to an SVN repository served via svnserve could use this flaw to cause the svnserve daemon to exit, leading to a denial of service.
(CVE-2013-2112)
All subversion users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, for the update to take effect, you must restart the httpd daemon, if you are using mod_dav_svn, and the svnserve daemon, if you are serving Subversion repositories via the svn:// protocol.
Solution
Update the affected packages.See Also
https://subversion.apache.org/security/CVE-2014-0032-advisory.txt
https://subversion.apache.org/security/CVE-2013-1968-advisory.txt
https://subversion.apache.org/security/CVE-2013-2112-advisory.txt
https://access.redhat.com/errata/RHSA-2014:0255
https://access.redhat.com/security/cve/cve-2013-2112
Plugin Details
Severity: High
ID: 72854
File Name: redhat-RHSA-2014-0255.nasl
Version: 1.15
Type: local
Agent: unix
Family: Red Hat Local Security Checks
Published: 3/6/2014
Updated: 1/14/2021
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.2
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
Vulnerability Information
CPE: cpe:/o:redhat:enterprise_linux:5, p-cpe:/a:redhat:enterprise_linux:subversion, p-cpe:/a:redhat:enterprise_linux:mod_dav_svn, p-cpe:/a:redhat:enterprise_linux:subversion-ruby, p-cpe:/a:redhat:enterprise_linux:subversion-kde, p-cpe:/a:redhat:enterprise_linux:subversion-javahl, p-cpe:/a:redhat:enterprise_linux:subversion-devel, cpe:/o:redhat:enterprise_linux:6, p-cpe:/a:redhat:enterprise_linux:subversion-perl, p-cpe:/a:redhat:enterprise_linux:subversion-gnome, p-cpe:/a:redhat:enterprise_linux:subversion-svn2cl, p-cpe:/a:redhat:enterprise_linux:subversion-debuginfo, cpe:/o:redhat:enterprise_linux:6.5
Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu
Exploit Ease: No known exploits are available
Patch Publication Date: 3/5/2014
Vulnerability Publication Date: 7/31/2013
Reference Information
CVE: CVE-2013-1968, CVE-2013-2112, CVE-2014-0032
RHSA: 2014:0255