The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.7.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a request for a URI that triggers a lookup for a virtual transaction name that does not exist.

It was discovered that the Subversion mod_dav_svn module incorrectly handled REPORT requests for a resource that does not exist. A remote attacker could use this issue to cause the server to crash, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-3580)

It was discovered that the Subversion mod_dav_svn module incorrectly handled requests requiring a lookup for a virtual transaction name that does not exist. A remote attacker could use this issue to cause the server to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-8108)

Evgeny Kotkov discovered that the Subversion mod_dav_svn module incorrectly handled large numbers of REPORT requests. A remote attacker could use this issue to cause the server to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-0202)

Evgeny Kotkov discovered that the Subversion mod_dav_svn and svnserve modules incorrectly certain crafted parameter combinations. A remote attacker could use this issue to cause the server to crash, resulting in a denial of service. (CVE-2015-0248)

Ivan Zhakov discovered that the Subversion mod_dav_svn module incorrectly handled crafted v1 HTTP protocol request sequences. A remote attacker could use this issue to spoof the svn:author property.
(CVE-2015-0251)

C. Michael Pilato discovered that the Subversion mod_dav_svn module incorrectly restricted anonymous access. A remote attacker could use this issue to read hidden files via the path name. This issue only affected Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-3184)

C. Michael Pilato discovered that Subversion incorrectly handled path-based authorization. A remote attacker could use this issue to obtain sensitive path information. (CVE-2015-3187).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A NULL pointer dereference flaw was found in the way the mod_dav_svn module handled certain requests for URIs that trigger a lookup of a virtual transaction name. A remote, unauthenticated attacker could send a request for a virtual transaction name that does not exist, causing mod_dav_svn to crash. (CVE-2014-8108)

A NULL pointer dereference flaw was found in the way the mod_dav_svn module handled REPORT requests. A remote, unauthenticated attacker could use a specially crafted REPORT request to crash mod_dav_svn.
(CVE-2014-3580)

The Apple Xcode installed on the remote Mac OS X host is prior to version 6.2. It is, therefore, affected by the following vulnerabilities :

  - Numerous errors exist related to the bundled version of Apache Subversion. (CVE-2014-3522, CVE-2014-3528,     CVE-2014-3580, CVE-2014-8108)

  - An error exists related to the bundled version of Git that allows arbitrary files to be added to the .git     folder. (CVE-2014-9390)

A NULL pointer dereference flaw was found in the way the mod_dav_svn module handled REPORT requests. A remote, unauthenticated attacker could use a specially crafted REPORT request to crash mod_dav_svn.
(CVE-2014-3580)

A NULL pointer dereference flaw was found in the way the mod_dav_svn module handled certain requests for URIs that trigger a lookup of a virtual transaction name. A remote, unauthenticated attacker could send a request for a virtual transaction name that does not exist, causing mod_dav_svn to crash. (CVE-2014-8108)

It was discovered that Subversion clients retrieved cached authentication credentials using the MD5 hash of the server realm string without also checking the server's URL. A malicious server able to provide a realm that triggers an MD5 collision could possibly use this flaw to obtain the credentials for a different realm.
(CVE-2014-3528)

After installing the updated packages, for the update to take effect, you must restart the httpd daemon, if you are using mod_dav_svn, and the svnserve daemon, if you are serving Subversion repositories via the svn:// protocol.

Updated subversion packages that fix three security issues are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. The mod_dav_svn module is used with the Apache HTTP Server to allow access to Subversion repositories via HTTP.

A NULL pointer dereference flaw was found in the way the mod_dav_svn module handled REPORT requests. A remote, unauthenticated attacker could use a specially crafted REPORT request to crash mod_dav_svn.
(CVE-2014-3580)

A NULL pointer dereference flaw was found in the way the mod_dav_svn module handled certain requests for URIs that trigger a lookup of a virtual transaction name. A remote, unauthenticated attacker could send a request for a virtual transaction name that does not exist, causing mod_dav_svn to crash. (CVE-2014-8108)

It was discovered that Subversion clients retrieved cached authentication credentials using the MD5 hash of the server realm string without also checking the server's URL. A malicious server able to provide a realm that triggers an MD5 collision could possibly use this flaw to obtain the credentials for a different realm.
(CVE-2014-3528)

Red Hat would like to thank the Subversion project for reporting CVE-2014-3580 and CVE-2014-8108. Upstream acknowledges Evgeny Kotkov of VisualSVN as the original reporter.

All subversion users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, for the update to take effect, you must restart the httpd daemon, if you are using mod_dav_svn, and the svnserve daemon, if you are serving Subversion repositories via the svn:// protocol.

From Red Hat Security Advisory 2015:0166 :

Updated subversion packages that fix three security issues are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. The mod_dav_svn module is used with the Apache HTTP Server to allow access to Subversion repositories via HTTP.

A NULL pointer dereference flaw was found in the way the mod_dav_svn module handled REPORT requests. A remote, unauthenticated attacker could use a specially crafted REPORT request to crash mod_dav_svn.
(CVE-2014-3580)

A NULL pointer dereference flaw was found in the way the mod_dav_svn module handled certain requests for URIs that trigger a lookup of a virtual transaction name. A remote, unauthenticated attacker could send a request for a virtual transaction name that does not exist, causing mod_dav_svn to crash. (CVE-2014-8108)

It was discovered that Subversion clients retrieved cached authentication credentials using the MD5 hash of the server realm string without also checking the server's URL. A malicious server able to provide a realm that triggers an MD5 collision could possibly use this flaw to obtain the credentials for a different realm.
(CVE-2014-3528)

Red Hat would like to thank the Subversion project for reporting CVE-2014-3580 and CVE-2014-8108. Upstream acknowledges Evgeny Kotkov of VisualSVN as the original reporter.

All subversion users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, for the update to take effect, you must restart the httpd daemon, if you are using mod_dav_svn, and the svnserve daemon, if you are serving Subversion repositories via the svn:// protocol.

The remote host is running a version of Apache SVN 1.7.x prior to 1.7.19 or 1.8.x prior to 1.8.11. It is, therefore, affected by multiple denial of service vulnerabilities :

  - A NULL pointer dereference flaw exists in 'mod_dav_svn'     that is triggered when handling REPORT requests. A     remote attacker, using a specially crafted request, can     cause the listener process to crash. (CVE-2014-3580)

  - A NULL pointer dereference flaw exists in 'mod_dav_svn'     that is triggered when handling requests for     non-existent virtual transaction names. A remote     attacker, using a specially crafted request, can cause     the listener process to crash. (CVE-2014-8108)

Versions of Apache Subversion prior to 1.7.19, or 1.8.x prior to 1.8.11 are affected by the following vulnerabilities :

 - When a resource is requested by 'mod_dav' that doesn't exist, 'mod_dav_svn' returns a NULL as the repository path. However, later when 'mod_dav' calls to handle the request, a SEGFAULT occurs, effectively crashing the service. (CVE-2014-3580)
 - A denial of service vulnerability affects the 'mod_dav_svn' module for the Apache HTTPD server. The problem occurs when handling a request for specially formatted URIs. The request would include a non-existent virtual transaction name, resulting in a NULL loop, effectively crashing the service. (CVE-2014-8108)

Updated subversion packages fix security vulnerabilities :

A NULL pointer dereference flaw was found in the way mod_dav_svn handled REPORT requests. A remote, unauthenticated attacker could use a crafted REPORT request to crash mod_dav_svn (CVE-2014-3580).

A NULL pointer dereference flaw was found in the way mod_dav_svn handled URIs for virtual transaction names. A remote, unauthenticated attacker could send a request for a virtual transaction name that does not exist, causing mod_dav_svn to crash (CVE-2014-8108).

This update includes the latest stable release of **Apache Subversion**, version **1.8.11**. Two security issues in mod_dav_svn are addressed in this release (CVE-2014-8108, CVE-2014-3580). For more details, see :

http://subversion.apache.org/security/CVE-2014-8108-advisory.txt http://subversion.apache.org/security/CVE-2014-3580-advisory.txt

**Client-side bugfixes:**

  - checkout/update: fix file externals failing to follow     history and subsequently silently failing     http://subversion.tigris.org/issues/show_bug.cgi?id=4185

    - patch: don't skip targets in valid --git difs

    - diff: make property output in diffs stable

    - diff: fix diff of local copied directory with props

    - diff: fix changelist filter for repos-WC and WC-WC

    - remove broken conflict resolver menu options that       always error out

    - improve gpg-agent support

    - fix crash in eclipse IDE with GNOME Keyring       http://subversion.tigris.org/issues/show_bug.cgi?id=34       98

    - fix externals shadowing a versioned directory       http://subversion.tigris.org/issues/show_bug.cgi?id=40       85

    - fix problems working on unix file systems that don't       support permissions

    - upgrade: keep external registrations       http://subversion.tigris.org/issues/show_bug.cgi?id=45       19

    - cleanup: iprove performance of recorded timestamp       fixups

    - translation updates for German

**Server-side bugfixes:**

  - disable revprop caching feature due to cache     invalidation problems

    - skip generating uniquifiers if rep-sharing is not       supported

    - mod_dav_svn: reject requests with missing repository       paths

    - mod_dav_svn: reject requests with invalid virtual       transaction names

    - mod_dav_svn: avoid unneeded memory growth in resource       walking       http://subversion.tigris.org/issues/show_bug.cgi?id=45       31

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This Apache Subversion update fixes the following security and non security issues.

  - Apache Subversion 1.8.11

  - This release addresses two security issues: [boo#909935]

  - CVE-2014-3580: mod_dav_svn DoS from invalid REPORT     requests.

  - CVE-2014-8108: mod_dav_svn DoS from use of invalid     transaction names.

  - Client-side bugfixes :

  - checkout/update: fix file externals failing to follow     history and subsequently silently failing

  - patch: don't skip targets in valid --git difs

  - diff: make property output in diffs stable

  - diff: fix diff of local copied directory with props

  - diff: fix changelist filter for repos-WC and WC-WC

  - remove broken conflict resolver menu options that always     error out

  - improve gpg-agent support

  - fix crash in eclipse IDE with GNOME Keyring

  - fix externals shadowing a versioned directory

  - fix problems working on unix file systems that don't     support permissions

  - upgrade: keep external registrations

  - cleanup: iprove performance of recorded timestamp fixups

  - translation updates for German

  - Server-side bugfixes :

  - disable revprop caching feature due to cache     invalidation problems

  - skip generating uniquifiers if rep-sharing is not     supported

  - mod_dav_svn: reject requests with missing repository     paths

  - mod_dav_svn: reject requests with invalid virtual     transaction names

  - mod_dav_svn: avoid unneeded memory growth in resource     walking

Subversion Project reports :

Subversion's mod_dav_svn Apache HTTPD server module will crash when it receives a REPORT request for some invalid formatted special URIs.

Subversion's mod_dav_svn Apache HTTPD server module will crash when it receives a request for some invalid formatted special URIs.

We consider this to be a medium risk vulnerability. Repositories which allow for anonymous reads will be vulnerable without authentication.
Unfortunately, no special configuration is required and all mod_dav_svn servers are vulnerable.

ID	Name	Product	Family	Severity
85579	Ubuntu 14.04 LTS : Subversion vulnerabilities (USN-2721-1)	Nessus	Ubuntu Local Security Checks	high
84372	Amazon Linux AMI : mod_dav_svn / subversion (ALAS-2015-555)	Nessus	Amazon Linux Local Security Checks	medium
81758	Apple Xcode < 6.2 (Mac OS X)	Nessus	MacOS X Local Security Checks	medium
81310	Scientific Linux Security Update : subversion on SL7.x x86_64 (20150210)	Nessus	Scientific Linux Local Security Checks	medium
81293	RHEL 7 : subversion (RHSA-2015:0166)	Nessus	Red Hat Local Security Checks	medium
81289	Oracle Linux 7 : subversion (ELSA-2015-0166)	Nessus	Oracle Linux Local Security Checks	medium
81278	CentOS 7 : subversion (CESA-2015:0166)	Nessus	CentOS Local Security Checks	medium
80864	Apache Subversion 1.7.x < 1.7.19 / 1.8.x < 1.8.11 Multiple Remote DoS	Nessus	Web Servers	medium
8616	Apache Subversion < 1.7.19 / 1.8.x < 1.8.11 Multiple DoS	Nessus Network Monitor	Web Servers	medium
80386	Mandriva Linux Security Advisory : subversion (MDVSA-2015:005)	Nessus	Mandriva Local Security Checks	medium
80375	Fedora 20 : subversion-1.8.11-1.fc20 (2014-17222)	Nessus	Fedora Local Security Checks	medium
80373	Fedora 21 : subversion-1.8.11-1.fc21 (2014-17118)	Nessus	Fedora Local Security Checks	medium
80299	openSUSE Security Update : subversion (openSUSE-SU-2014:1725-1)	Nessus	SuSE Local Security Checks	medium
80039	FreeBSD : subversion -- DoS vulnerabilities (f5561ade-846c-11e4-b7a7-20cf30e32f6d)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2014-8108

high

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium