TortoiseSVN < 1.5.6 / 1.6.0-1.6.3 Multiple Integer Overflows

high Nessus Network Monitor Plugin ID 5139

Synopsis

The remote host is vulnerable to multiple attack vectors.

Description

The installed version of the TortoiseSVN is affected by multiple heap overflow issues. Specifically, the 'libsvn_delta' library fails to perform sufficient boundary checks before processing certain svndiff streams. An attacker with commit access to a vulnerable Subversion server could exploit this vulnerability from a Subversion client to trigger a heap overflow on the server. Typically such an attack would result in a denial of service condition or arbitrary code execution. An attacker could also trigger this issue from a rogue Subversion server on a Subversion client in response to a checkout or update request.

Solution

Upgrade to TortoiseSVN 1.5.7/1.6.4 or later.

Plugin Details

Severity: High

ID: 5139

Family: Generic

Published: 8/25/2009

Updated: 3/6/2019

Nessus ID: 40620

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS v3

Risk Factor: High

Base Score: 7.3

Temporal Score: 6.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:subversion:subversion

Patch Publication Date: 8/6/2009

Vulnerability Publication Date: 8/6/2009

Reference Information

CVE: CVE-2009-2411

BID: 35983

Detections

Analytics