CVE-2013-1896

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI.

References

http://www.apache.org/dist/httpd/Announcement2.2.html

http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/mod_dav.c?view=log

http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/mod_dav.c?r1=1482522&r2=1485668&diff_format=h

http://lists.opensuse.org/opensuse-updates/2013-08/msg00026.html

http://rhn.redhat.com/errata/RHSA-2013-1156.html

http://www.ubuntu.com/usn/USN-1903-1

http://lists.opensuse.org/opensuse-updates/2013-08/msg00029.html

http://lists.opensuse.org/opensuse-updates/2013-08/msg00030.html

http://www-01.ibm.com/support/docview.wss?uid=swg21644047

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1896

https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c03922406-1%257CdocLocale%253D%257CcalledBy%253D&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken

http://rhn.redhat.com/errata/RHSA-2013-1209.html

http://rhn.redhat.com/errata/RHSA-2013-1207.html

http://rhn.redhat.com/errata/RHSA-2013-1208.html

http://secunia.com/advisories/55032

http://support.apple.com/kb/HT6150

https://httpd.apache.org/security/vulnerabilities_24.html

http://www.securityfocus.com/bid/61129

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19747

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18835

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

Details

Source: MITRE

Published: 2013-07-10

Updated: 2021-06-06

Type: CWE-264

Risk Information

CVSS v2

Base Score: 4.3

Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

Impact Score: 2.9

Exploitability Score: 8.6

Severity: MEDIUM

Tenable Plugins

View all (40 total)

IDNameProductFamilySeverity
144708IBM HTTP Server 8.5.0.0 <= 8.5.5.0 / 8.0.0.0 <= 8.0.0.6 / 7.0.0.0 <= 7.0.0.29 / 6.1.0.0 <= 6.1.0.45 (227047)NessusWeb Servers
medium
98903Apache 2.4.x < 2.4.6 Multiple VulnerabilitiesWeb Application ScanningComponent Vulnerability
critical
84878Juniper NSM < 2012.2R9 Apache HTTP Server Multiple Vulnerabilities (JSA10685) (credentialed check)NessusMisc.
medium
84877Juniper NSM < 2012.2R9 Apache HTTP Server Multiple Vulnerabilities (JSA10685)NessusMisc.
medium
83632SUSE SLES10 Security Update : apache2 (SUSE-SU-2014:1082-1)NessusSuSE Local Security Checks
medium
80585Oracle Solaris Third-Party Patch Update : apache (cve_2013_1896_denial_of)NessusSolaris Local Security Checks
medium
80195Juniper Junos Space < 13.3R1.8 Multiple Vulnerabilities (JSA10627)NessusJunos Local Security Checks
critical
80043openSUSE Security Update : apache2 (openSUSE-SU-2014:1647-1)NessusSuSE Local Security Checks
medium
76239RHEL 5 / 6 : JBoss Web Server (RHSA-2013:1133)NessusRed Hat Local Security Checks
medium
75110openSUSE Security Update : apache2 (openSUSE-SU-2013:1340-1)NessusSuSE Local Security Checks
medium
75109openSUSE Security Update : apache2 (openSUSE-SU-2013:1337-1)NessusSuSE Local Security Checks
medium
8138Mac OS X < 10.9.2 Multiple Vulnerabilities Nessus Network MonitorWeb Clients
critical
72688Mac OS X Multiple Vulnerabilities (Security Update 2014-001) (BEAST)NessusMacOS X Local Security Checks
critical
72687Mac OS X 10.9.x < 10.9.2 Multiple VulnerabilitiesNessusMacOS X Local Security Checks
critical
72238JBoss Enterprise Application Platform 6.1.1 Update (RHSA-2013:1209)NessusRed Hat Local Security Checks
medium
72061IBM WebSphere Application Server 7.0 < Fix Pack 31 Multiple VulnerabilitiesNessusWeb Servers
medium
71229IBM WebSphere Application Server 8.5 < Fix Pack 8.5.5.1 Multiple VulnerabilitiesNessusWeb Servers
medium
70085GLSA-201309-12 : Apache HTTP Server: Multiple vulnerabilitiesNessusGentoo Local Security Checks
medium
70022IBM WebSphere Application Server 6.1 < Fix Pack 47 Multiple VulnerabilitiesNessusWeb Servers
critical
69883RHEL 6 : JBoss EAP (RHSA-2013:1208)NessusRed Hat Local Security Checks
medium
69882RHEL 5 : JBoss EAP (RHSA-2013:1207)NessusRed Hat Local Security Checks
medium
69474SuSE 11.2 / 11.3 Security Update : Apache2 (SAT Patch Numbers 8137 / 8138)NessusSuSE Local Security Checks
medium
69449IBM WebSphere Application Server 8.0 < Fix Pack 7 Multiple VulnerabilitiesNessusWeb Servers
high
69380Fedora 18 : httpd-2.4.6-2.fc18 (2013-13922)NessusFedora Local Security Checks
high
69342Scientific Linux Security Update : httpd on SL5.x, SL6.x i386/x86_64 (20130813)NessusScientific Linux Local Security Checks
medium
69341RHEL 5 / 6 : httpd (RHSA-2013:1156)NessusRed Hat Local Security Checks
medium
69340Oracle Linux 5 / 6 : httpd (ELSA-2013-1156)NessusOracle Linux Local Security Checks
medium
69336CentOS 5 / 6 : httpd (CESA-2013:1156)NessusCentOS Local Security Checks
medium
69290Fedora 19 : httpd-2.4.6-2.fc19 (2013-13994)NessusFedora Local Security Checks
high
69225Slackware 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / 14.0 / current : httpd (SSA:2013-218-02)NessusSlackware Local Security Checks
high
801401Apache 2.4 < 2.4.5 Multiple VulnerabilitiesLog Correlation EngineWeb Servers
high
6942Apache 2.4.1 to 2.4.4 Multiple VulnerabilitiesNessus Network MonitorWeb Servers
high
69014Apache 2.4.x < 2.4.5 Multiple VulnerabilitiesNessusWeb Servers
critical
68990FreeBSD : apache24 -- several vulnerabilities (ca4d63fb-f15c-11e2-b183-20cf30e32f6d)NessusFreeBSD Local Security Checks
high
68915Apache 2.2.x < 2.2.25 Multiple VulnerabilitiesNessusWeb Servers
medium
68902Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 : apache2 vulnerabilities (USN-1903-1)NessusUbuntu Local Security Checks
medium
67253Mandriva Linux Security Advisory : apache (MDVSA-2013:193)NessusMandriva Local Security Checks
medium
67194FreeBSD : apache22 -- several vulnerabilities (f3d24aee-e5ad-11e2-b183-20cf30e32f6d)NessusFreeBSD Local Security Checks
medium
801383Apache 2.2.x < 2.2.25 Remote Denial of Service VulnerabilityLog Correlation EngineWeb Servers
medium
6927Apache 2.2.x < 2.2.25 Remote Denial of Service VulnerabilityNessus Network MonitorWeb Servers
low