CVE-2014-0032

Published: Feb 14, 2014Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The get_resource function in repos.c in the mod_dav_svn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service (crash) via vectors related to the server root and request methods other than GET, as demonstrated by the "svn ls http://svn.example.com" command.

Affected (21)

Products: Apache: Subversion

1 product

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Apache Subversion	Version 1.8.0
Apache Subversion	Version 1.8.1
Apache Subversion	Version 1.8.2
Apache Subversion	Version 1.8.3
Apache Subversion	Version 1.8.4
Apache Subversion	Version 1.8.5

Configuration B

15 vulnerable

Vulnerable Software	Affected Versions
Apache Subversion	Up to 1.7.14
Apache Subversion	Version 1.7.0
Apache Subversion	Version 1.7.10
Apache Subversion	Version 1.7.11
Apache Subversion	Version 1.7.12
Apache Subversion	Version 1.7.13
Apache Subversion	Version 1.7.1
Apache Subversion	Version 1.7.2
Apache Subversion	Version 1.7.3
Apache Subversion	Version 1.7.4
Apache Subversion	Version 1.7.5
Apache Subversion	Version 1.7.6
Apache Subversion	Version 1.7.7
Apache Subversion	Version 1.7.8
Apache Subversion	Version 1.7.9

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (38)

http://lists.opensuse.org/opensuse-updates/2014-02/msg00086.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2014-03/msg00011.html

Source: secalert@redhat.com

http://mail-archives.apache.org/mod_mbox/subversion-dev/201401.mbox/%3C52D328AB.8090502%40reser.org%3E

Source: secalert@redhat.com

http://mail-archives.apache.org/mod_mbox/subversion-dev/201401.mbox/%3C871u0gqb0d.fsf%40ntlworld.com%3E

Source: secalert@redhat.com

http://mail-archives.apache.org/mod_mbox/subversion-dev/201401.mbox/%3CCANvU9scLHr2yOLABW8q6_wNzhEf7pWM=NiavGcobqvUuyhKyAA%40mail.gmail.com%3E

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2014-0255.html

Source: secalert@redhat.com

http://secunia.com/advisories/56822

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/60722

Source: secalert@redhat.com

http://secunia.com/advisories/61321

Source: secalert@redhat.com

http://support.apple.com/kb/HT6444

Source: secalert@redhat.com

http://svn.apache.org/repos/asf/subversion/tags/1.7.15/CHANGES

Source: secalert@redhat.com

http://svn.apache.org/repos/asf/subversion/tags/1.8.6/CHANGES

Source: secalert@redhat.com

http://svn.apache.org/viewvc?view=revision&revision=1557320

Source: secalert@redhat.com

Patch

http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html

Source: secalert@redhat.com

http://www.osvdb.org/102927

Source: secalert@redhat.com

http://www.securityfocus.com/bid/65434

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-2316-1

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/90986

Source: secalert@redhat.com

https://security.gentoo.org/glsa/201610-05

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2014-02/msg00086.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-updates/2014-03/msg00011.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://mail-archives.apache.org/mod_mbox/subversion-dev/201401.mbox/%3C52D328AB.8090502%40reser.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

http://mail-archives.apache.org/mod_mbox/subversion-dev/201401.mbox/%3C871u0gqb0d.fsf%40ntlworld.com%3E

Source: af854a3a-2127-422b-91ae-364da2661108

http://mail-archives.apache.org/mod_mbox/subversion-dev/201401.mbox/%3CCANvU9scLHr2yOLABW8q6_wNzhEf7pWM=NiavGcobqvUuyhKyAA%40mail.gmail.com%3E

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2014-0255.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/56822

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/60722

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/61321

Source: af854a3a-2127-422b-91ae-364da2661108

http://support.apple.com/kb/HT6444

Source: af854a3a-2127-422b-91ae-364da2661108

http://svn.apache.org/repos/asf/subversion/tags/1.7.15/CHANGES

Source: af854a3a-2127-422b-91ae-364da2661108

http://svn.apache.org/repos/asf/subversion/tags/1.8.6/CHANGES

Source: af854a3a-2127-422b-91ae-364da2661108

http://svn.apache.org/viewvc?view=revision&revision=1557320

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.osvdb.org/102927

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/65434

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-2316-1

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/90986

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.gentoo.org/glsa/201610-05

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.