GLSA-200407-20 : Subversion: Vulnerability in mod_authz_svn

low Nessus Plugin ID 14553

Synopsis

The remote Gentoo host is missing one or more security-related patches.

Description

The remote host is affected by the vulnerability described in GLSA-200407-20 (Subversion: Vulnerability in mod_authz_svn)

Users with write access to part of a Subversion repository may bypass read restrictions on any part of that repository. This can be done using an 'svn copy' command to copy the portion of a repository the user wishes to read into an area where they have write access.
Since copies are versioned, any such copy attempts will be readily apparent.
Impact :

This is a low-risk vulnerability. It affects only users of Subversion who are running servers inside Apache and using mod_authz_svn.
Additionally, this vulnerability may be exploited only by users with write access to some portion of a repository.
Workaround :

Keep sensitive content separated into different Subversion repositories, or disable the Apache Subversion server and use svnserve instead.

Solution

All Subversion users should upgrade to the latest available version:
# emerge sync # emerge -pv '>=dev-util/subversion-1.0.6' # emerve '>=dev-util/subversion-1.0.6'

Plugin Details

Severity: Low

ID: 14553

File Name: gentoo_GLSA-200407-20.nasl

Version: 1.16

Type: local

Family: Gentoo Local Security Checks

Published: 8/30/2004

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Low

Base Score: 2.1

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Information

CPE: p-cpe:/a:gentoo:linux:subversion, cpe:/o:gentoo:linux

Required KB Items: Host/local_checks_enabled, Host/Gentoo/release, Host/Gentoo/qpkg-list

Patch Publication Date: 7/26/2004

Vulnerability Publication Date: 7/26/2004

Reference Information

CVE: CVE-2004-1438

GLSA: 200407-20

Detections

Analytics