Multiple integer overflows in the libsvn_delta library in Subversion before 1.5.7, and 1.6.x before 1.6.4, allow remote authenticated users and remote Subversion servers to execute arbitrary code via an svndiff stream with large windows that trigger a heap-based buffer overflow, a related issue to CVE-2009-2412.

From Red Hat Security Advisory 2009:1203 :

Updated subversion packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes.

Matt Lewis, of Google, reported multiple heap overflow flaws in Subversion (server and client) when parsing binary deltas. A malicious user with commit access to a server could use these flaws to cause a heap overflow on that server. A malicious server could use these flaws to cause a heap overflow on a client when it attempts to checkout or update. These heap overflows can result in a crash or, possibly, arbitrary code execution. (CVE-2009-2411)

All Subversion users should upgrade to these updated packages, which contain a backported patch to correct these issues. After installing the updated packages, the Subversion server must be restarted for the update to take effect: restart httpd if you are using mod_dav_svn, or restart svnserve if it is used.

CVE-2009-2411 subversion: multiple heap overflow issues

Matt Lewis, of Google, reported multiple heap overflow flaws in Subversion (server and client) when parsing binary deltas. A malicious user with commit access to a server could use these flaws to cause a heap overflow on that server. A malicious server could use these flaws to cause a heap overflow on a client when it attempts to checkout or update. These heap overflows can result in a crash or, possibly, arbitrary code execution. (CVE-2009-2411)

After installing the updated packages, the Subversion server must be restarted for the update to take effect: restart httpd if you are using mod_dav_svn, or restart svnserve if it is used.

This update of subversion fixes some buffer overflows in the client and server code that can occur while parsing binary diffs.
(CVE-2009-2411)

Matt Lewis discovered that Subversion performs insufficient input validation of svndiff streams. Malicious servers could cause heap overflows in clients, and malicious clients with commit access could cause heap overflows in servers, possibly leading to arbitrary code execution in both cases.

Updated subversion packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes.

Matt Lewis, of Google, reported multiple heap overflow flaws in Subversion (server and client) when parsing binary deltas. A malicious user with commit access to a server could use these flaws to cause a heap overflow on that server. A malicious server could use these flaws to cause a heap overflow on a client when it attempts to checkout or update. These heap overflows can result in a crash or, possibly, arbitrary code execution. (CVE-2009-2411)

All Subversion users should upgrade to these updated packages, which contain a backported patch to correct these issues. After installing the updated packages, the Subversion server must be restarted for the update to take effect: restart httpd if you are using mod_dav_svn, or restart svnserve if it is used.

The remote host is running a version of Mac OS X 10.6 that is older than version 10.6.2.  Mac OS X 10.6.2 contains security fixes for the following products : 

  - Adaptive Firewall

  - Apache

  - Apache Protable Runtime

  - Certificate Assistant

  - CoreMedia

  - CUPS

  - DoveCot

  - fetchmail

  - file

  - FTP Server

  - Help Viewer

  - ImageIO

  - IOKit

  - IPSec

  - Kernel

  - Launch Services

  - libsecurity

  - libxml

 Login Window

  - OpenLDAP

  - QuickDraw Manager

QuickTime

  - Screen Sharing

  - Subversion

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.2.

Mac OS X 10.6.2 contains security fixes for the following products :

  - Adaptive Firewall
  - Apache
  - Apache Portable Runtime
  - Certificate Assistant
  - CoreMedia
  - CUPS
  - Dovecot
  - fetchmail
  - file
  - FTP Server
  - Help Viewer
  - ImageIO
  - IOKit
  - IPSec
  - Kernel
  - Launch Services
  - libsecurity
  - libxml
  - Login Window
  - OpenLDAP
  - QuickDraw Manager
  - QuickTime
  - Screen Sharing
  - Subversion

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2009-006 applied.

This security update contains fixes for the following products :

  - AFP Client
  - Adaptive Firewall
  - Apache
  - Apache Portable Runtime
  - ATS
  - Certificate Assistant
  - CoreGraphics
  - CUPS
  - Dictionary
  - DirectoryService
  - Disk Images
  - Event Monitor
  - fetchmail
  - FTP Server
  - Help Viewer
  - International Components for Unicode
  - IOKit
  - IPSec
  - libsecurity
  - libxml
  - OpenLDAP
  - OpenSSH
  - PHP
  - QuickDraw Manager
  - QuickLook
  - FreeRADIUS
  - Screen Sharing
  - Spotlight
  - Subversion

This update of subversion some buffer overflows in the client and server code that can occur while parsing binary diffs. (CVE-2009-2411)

The installed version of SVN is affected by multiple heap overflow issues.  Specifically, the 'libsvn_delta' library fails to perform sufficient boundary checks before processing certain svndiff streams.  An attacker with commit access to a vulnerable Subversion server could exploit this vulnerability from a Subversion client to trigger a heap overflow on the server.  Typically such an attack would result in a denial of service condition or arbitrary code execution.  An attacker could also trigger this issue from a rogue Subversion server on a Subversion client in response to a checkout or update request.  

The installed version of the TortoiseSVN is affected by multiple heap overflow issues.  Specifically, the 'libsvn_delta' library fails to perform sufficient boundary checks before processing certain svndiff streams.  An attacker with commit access to a vulnerable Subversion server could exploit this vulnerability from a Subversion client to trigger a heap overflow on the server.  Typically such an attack would result in a denial of service condition or arbitrary code execution.  An attacker could also trigger this issue from a rogue Subversion server on a Subversion client in response to a checkout or update request.

The remote host is affected by the vulnerability described in GLSA-200908-05 (Subversion: Remote execution of arbitrary code)

    Matt Lewis of Google reported multiple integer overflows in the     libsvn_delta library, possibly leading to heap-based buffer overflows.
  Impact :

    A remote attacker with commit access could exploit this vulnerability     by sending a specially crafted commit to a Subversion server, or a     remote attacker could entice a user to check out or update a repository     from a malicious Subversion server, possibly resulting in the execution     of arbitrary code with the privileges of the user running the server or     client.
  Workaround :

    There is no known workaround at this time.

The installed version of Subversion Client or Server is affected by multiple heap overflow issues.

Specifically, the 'libsvn_delta' library fails to perform sufficient boundary checks before processing certain svndiff streams. An attacker with commit access to a vulnerable Subversion server can exploit this vulnerability from a Subversion client to trigger a heap overflow on the server. Typically such an attack would result in a denial of service condition or arbitrary code execution on the remote server.

An attacker can also trigger this issue from a rogue Subversion server on a Subversion client in response to a checkout or update request.

This version upgrade of subversion to 1.5.7 fixes some buffer overflows in the client and server code that can occur while parsing binary diffs. (CVE-2009-2411) Version 1.5.7 also fixes various non-security bugs.

A vulnerability has been found and corrected in subversion :

Multiple integer overflows in the libsvn_delta library in Subversion before 1.5.7, and 1.6.x before 1.6.4, allow remote authenticated users and remote Subversion servers to execute arbitrary code via an svndiff stream with large windows that trigger a heap-based buffer overflow, a related issue to CVE-2009-2412 (CVE-2009-2411).

This update provides a solution to this vulnerability and in turn upgrades subversion where possible to provide additional features and upstream bugfixes and adds required dependencies where needed.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

This update includes the latest stable release of Subversion, fixing many bugs and a security issue: Matt Lewis reported multiple heap overflow flaws in Subversion (servers and clients) when parsing binary deltas. Malicious users with commit access to a vulnerable server could uses these flaws to cause a heap overflow on the server running Subversion. A malicious Subversion server could use these flaws to cause a heap overflow on vulnerable clients when they attempt to checkout or update, resulting in a crash or, possibly, arbitrary code execution on the vulnerable client. (CVE-2009-2411) This update also adds support for storing passwords in the GNOME Keyring or KDE Wallet, via the new subversion-gnome and subversion-kde subpackages. For more details of the bug fixes included in this update, see:
http://svn.collab.net/repos/svn/tags/1.6.4/CHANGES

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update includes the latest stable release of Subversion, including several enhancements, many bug fixes, and a fix for a security issue: Matt Lewis reported multiple heap overflow flaws in Subversion (servers and clients) when parsing binary deltas. Malicious users with commit access to a vulnerable server could uses these flaws to cause a heap overflow on the server running Subversion. A malicious Subversion server could use these flaws to cause a heap overflow on vulnerable clients when they attempt to checkout or update, resulting in a crash or, possibly, arbitrary code execution on the vulnerable client. (CVE-2009-2411) Version 1.6 offers many bug fixes and enhancements over 1.5, with the notable major features: - identical files share storage space in repository - file-externals support for intra-repository files - 'tree' conflicts now handled more gracefully
- repository root relative URL support on most commands For more information on changes in 1.6, see the release notes:
http://subversion.tigris.org/svn_1.6_releasenotes.html This update includes the latest release of Subversion, version 1.6.2. Version 1.6 offers many bug fixes and enhancements over 1.5, with the notable major features: * identical files share storage space in repository * file- externals support for intra-repository files * 'tree' conflicts now handled more gracefully * repository root relative URL support on most commands

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Matt Lewis discovered that Subversion did not properly sanitize its input when processing svndiff streams, leading to various integer and heap overflows. If a user or automated system processed crafted input, a remote attacker could cause a denial of service or potentially execute arbitrary code as the user processing the input.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New subversion packages are available for Slackware 12.0, 12.1, 12.2, and -current to fix a security issue.

A Subversion Security Advisory reports :

Subversion clients and servers have multiple heap overflow issues in the parsing of binary deltas. This is related to an allocation vulnerability in the APR library used by Subversion.

Clients with commit access to a vulnerable server can cause a remote heap overflow; servers can cause a heap overflow on vulnerable clients that try to do a checkout or update.

This can lead to a DoS (an exploit has been tested) and to arbitrary code execution (no exploit tested, but the possibility is clear).

ID	Name	Product	Family	Severity
67906	Oracle Linux 4 / 5 : subversion (ELSA-2009-1203)	Nessus	Oracle Linux Local Security Checks	high
60638	Scientific Linux Security Update : subversion on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
51720	SuSE 10 Security Update : subversion (ZYPP Patch Number 6423)	Nessus	SuSE Local Security Checks	high
44720	Debian DSA-1855-1 : subversion - heap overflow	Nessus	Debian Local Security Checks	high
43775	CentOS 5 : subversion (CESA-2009:1203)	Nessus	CentOS Local Security Checks	high
800795	Mac OS X 10.6 < 10.6.2 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	high
5227	Mac OS X 10.6 < 10.6.2 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
42434	Mac OS X 10.6.x < 10.6.2 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
42433	Mac OS X Multiple Vulnerabilities (Security Update 2009-006)	Nessus	MacOS X Local Security Checks	critical
42036	openSUSE 10 Security Update : subversion (subversion-6418)	Nessus	SuSE Local Security Checks	high
5140	SVN < 1.5.6 / 1.6.0-1.6.3 Multiple Integer Overflows (deprecated)	Nessus Network Monitor	Generic	high
5139	TortoiseSVN < 1.5.6 / 1.6.0-1.6.3 Multiple Integer Overflows	Nessus Network Monitor	Generic	high
40630	GLSA-200908-05 : Subversion: Remote execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
40620	Apache Subversion < 1.6.4 'libsvn_delta' Library Binary Delta svndiff Stream Parsing Multiple Overflows	Nessus	Windows	high
40589	openSUSE Security Update : subversion (subversion-1185)	Nessus	SuSE Local Security Checks	high
40588	openSUSE Security Update : subversion (subversion-1185)	Nessus	SuSE Local Security Checks	high
40541	RHEL 4 / 5 : subversion (RHSA-2009:1203)	Nessus	Red Hat Local Security Checks	high
40540	Mandriva Linux Security Advisory : subversion (MDVSA-2009:199-1)	Nessus	Mandriva Local Security Checks	high
40536	Fedora 11 : subversion-1.6.4-2.fc11 (2009-8449)	Nessus	Fedora Local Security Checks	high
40534	Fedora 10 : subversion-1.6.4-2.fc10 (2009-8432)	Nessus	Fedora Local Security Checks	high
40528	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : subversion vulnerability (USN-812-1)	Nessus	Ubuntu Local Security Checks	high
40511	Slackware 12.0 / 12.1 / 12.2 / current : subversion (SSA:2009-219-01)	Nessus	Slackware Local Security Checks	high
40508	FreeBSD : subversion -- heap overflow vulnerability (bce1f76d-82d0-11de-88ea-001a4d49522b)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2009-2411

critical

Tenable Plugins

high

high

high

high

high

high

critical

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high