The mod_authz_svn module in Subversion 1.0.7 and earlier does not properly restrict access to all metadata on unreadable paths, which could allow remote attackers to gain sensitive information via (1) svn log -v, (2) svn propget, or (3) svn blame, and other commands that follow renames.

In some situations, subversion metadata may be unexpectedly disclosed via WebDAV. A subversion advisory states :

mod_authz_svn, the Apache httpd module which does path-based authorization on Subversion repositories, is not correctly protecting all metadata on unreadable paths.

This security issue is not about revealing the contents of protected files: it only reveals metadata about protected areas such as paths and log messages. This may or may not be important to your organization, depending on how you're using path-based authorization, and the sensitivity of the metadata.

The remote host is affected by the vulnerability described in GLSA-200409-35 (Subversion: Metadata information leak)

    There is a bug in mod_authz_svn that causes it to reveal logged metadata     regarding commits to protected areas.
  Impact :

    Protected files themselves will not be revealed, but an attacker could use     the metadata to reveal the existence of protected areas, such as paths,     file versions, and the commit logs from those areas.
  Workaround :

    Rather than using mod_authz_svn, move protected areas into separate     repositories and use native Apache authentication to make these     repositories unreadable.

The remote host is running Subversion, an open-source file management product.  According to the version number, the remote system is prone to an information disclosure issue. An attacker may gather information about the remote host using metadata in unreadable paths. 

This update includes the latest stable release of Subversion, including a security fix for information disclosure bugs in handling of metadata (such as log messages) in repositories using mod_authz_svn for path-based access-control (CVE-2004-0749).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

You are running a version of Subversion which is older than 1.0.8 or 1.1.0-rc4. 

A flaw exists in older version, in the apache module mod_authz_svn, which fails to properly restrict access to metadata within unreadable paths. 

An attacker can read metadata in unreadable paths, which can contain sensitive information such as logs and paths.

ID	Name	Product	Family	Type	Severity
37142	FreeBSD : subversion -- WebDAV fails to protect metadata (184f5d0b-0fe8-11d9-8a8a-000c41e2cdad)	Nessus	FreeBSD Local Security Checks	Local	medium
15406	GLSA-200409-35 : Subversion: Metadata information leak	Nessus	Gentoo Local Security Checks	Local	medium
2315	Subversion (SVN) Unreadable Path Metadata Information Disclosure (deprecated)	Nessus Network Monitor	Generic		medium
14808	Fedora Core 2 : subversion-1.0.8-1 (2004-318)	Nessus	Fedora Local Security Checks	Local	medium
14800	Subversion < 1.0.8 / 1.1.0-rc4 mod_authz_svn Unreadable Path Metadata Information Disclosure	Nessus	Misc.	Remote	medium

Detections

Analytics

CVE-2004-0749

high

Tenable Plugins

medium

medium

medium

medium

medium