The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1633 advisory.

    Subversion (SVN) is a concurrent version control system which enables one     or more users to collaborate in developing and maintaining a hierarchy of     files and directories while keeping a history of all changes.
    The mod_dav_svn module is used with the Apache HTTP Server to allow access     to Subversion repositories via HTTP.

    An assertion failure flaw was found in the way the SVN server processed     certain requests with dynamically evaluated revision numbers. A remote     attacker could use this flaw to cause the SVN server (both svnserve and     httpd with the mod_dav_svn module) to crash. (CVE-2015-0248)

    It was found that the mod_dav_svn module did not properly validate the     svn:author property of certain requests. An attacker able to create new     revisions could use this flaw to spoof the svn:author property.
    (CVE-2015-0251)

    It was found that when an SVN server (both svnserve and httpd with the     mod_dav_svn module) searched the history of a file or a directory, it would     disclose its location in the repository if that file or directory was not     readable (for example, if it had been moved). (CVE-2015-3187)

    Red Hat would like to thank the Apache Software Foundation for reporting     these issues. Upstream acknowledges Evgeny Kotkov of VisualSVN as the     original reporter of CVE-2015-0248 and CVE-2015-0251, and C. Michael Pilato     of CollabNet as the original reporter of CVE-2015-3187.

    All subversion users should upgrade to these updated packages, which     contain backported patches to correct these issues. After installing the     updated packages, for the update to take effect, you must restart the httpd     daemon, if you are using mod_dav_svn, and the svnserve daemon, if you are     serving Subversion repositories via the svn:// protocol.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 6 : subversion (RHSA-2015:1633)

high Nessus Plugin ID 85494

Version 2.11

Version 2.10

Version 2.11 Nov 5, 2024, 12:50 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Plugin metadata Plugin Feed: 202411051250
Version 2.10 Apr 28, 2024, 1:01 AM CVSS metrics ("CVSSv2 score" set to 4.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N") CVSS metrics ("CVSSv3 score" set to 7.5) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:U/RL:O/RC:C") CVSSv2 score source (set to "CVE-2015-3187") Detection (updated detection logic) Plugin metadata Reference Plugin Feed: 202404280101