Detections
Analytics
Apache Subversion < 1.6.21 / 1.7.x < 1.7.9 Multiple DoS
medium Nessus Plugin ID 66474
Language:
Synopsis
The remote host has an application that is affected by multiple denial of service vulnerabilities.Description
The version of Apache Subversion Server installed on the remote host is prior to 1.6.21 or 1.7.x prior to 1.7.9. It is, therefore, affected by multiple denial of service (DoS) vulnerabilities in the 'mod_dav_svn' Apache HTTPD server module :- A flaw exists in 'mod_dav_svn' that is triggered when handling node properties. (CVE-2013-1845)
- A NULL pointer dereference exists in the 'mod_dav_svn' module, triggered during the handling of a crafted Log REPORT request, URL lock request, LOCK request against non-existent URL, or URL PROPFIND request.
(CVE-2013-1846, CVE-2013-1847, CVE-2013-1849)
- A NULL pointer dereference exists in the 'mod_dav_svn' module, triggered during the handling of a crafted Log REPORT request. This flaw reportedly affects Apache Subversion 1.7.x only. (CVE-2013-1884)
Solution
Upgrade to Apache Subversion Server 1.6.21 / 1.7.9 or later.See Also
http://subversion.apache.org/security/CVE-2013-1845-advisory.txt
http://subversion.apache.org/security/CVE-2013-1846-advisory.txt
http://subversion.apache.org/security/CVE-2013-1847-advisory.txt
http://subversion.apache.org/security/CVE-2013-1849-advisory.txt
http://subversion.apache.org/security/CVE-2013-1884-advisory.txt
Plugin Details
Severity: Medium
ID: 66474
File Name: subversion_1_6_21.nasl
Version: 1.6
Type: local
Agent: windows
Family: Windows
Published: 5/16/2013
Updated: 7/30/2018
Configuration: Enable paranoid mode
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P
Vulnerability Information
CPE: cpe:/a:apache:subversion
Required KB Items: Settings/ParanoidReport, installed_sw/Subversion Server
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 4/4/2013
Vulnerability Publication Date: 4/4/2013
Reference Information
CVE: CVE-2013-1845, CVE-2013-1846, CVE-2013-1847, CVE-2013-1849, CVE-2013-1884