Fedora 10 : subversion-1.6.4-2.fc10 (2009-8432)

This script is Copyright (C) 2009-2015 Tenable Network Security, Inc.


Synopsis :

The remote Fedora host is missing a security update.

Description :

This update includes the latest stable release of Subversion,
including several enhancements, many bug fixes, and a fix for a
security issue: Matt Lewis reported multiple heap overflow flaws in
Subversion (servers and clients) when parsing binary deltas. Malicious
users with commit access to a vulnerable server could uses these flaws
to cause a heap overflow on the server running Subversion. A malicious
Subversion server could use these flaws to cause a heap overflow on
vulnerable clients when they attempt to checkout or update, resulting
in a crash or, possibly, arbitrary code execution on the vulnerable
client. (CVE-2009-2411) Version 1.6 offers many bug fixes and
enhancements over 1.5, with the notable major features: - identical
files share storage space in repository - file-externals support for
intra-repository files - 'tree' conflicts now handled more gracefully
- repository root relative URL support on most commands For more
information on changes in 1.6, see the release notes:
http://subversion.tigris.org/svn_1.6_releasenotes.html This update
includes the latest release of Subversion, version 1.6.2. Version 1.6
offers many bug fixes and enhancements over 1.5, with the notable
major features: * identical files share storage space in repository *
file- externals support for intra-repository files * 'tree' conflicts
now handled more gracefully * repository root relative URL support on
most commands

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

See also :

http://subversion.tigris.org/svn_1.6_releasenotes.html
https://bugzilla.redhat.com/show_bug.cgi?id=514744
http://www.nessus.org/u?60939a02

Solution :

Update the affected subversion package.

Risk factor :

High / CVSS Base Score : 8.5
(CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C)
CVSS Temporal Score : 7.4
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : false

Family: Fedora Local Security Checks

Nessus Plugin ID: 40534 (fedora_2009-8432.nasl)

Bugtraq ID: 35983

CVE ID: CVE-2009-2411

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now