Apache Subversion < 1.6.23 / 1.7.x < 1.7.10 Multiple Vulnerabilities

High Nessus Network Monitor Plugin ID 6854

Synopsis

The remote host is running a version of Apache Subversion that is vulnerable to multiple attack vectors.

Description

Versions of Apache Subversion prior to 1.6.23, or 1.7.x prior to 1.7.10 are affected by the following vulnerabilities :

- Remote denial-of-service vulnerabilities exist due to an error in the 'svnserve' server, as it does not properly handle aborted connection messages. (CVE-2013-1968, CVE-2013-2112)
- A command injection vulnerability exists in the 'svn-keyword-check.pl' hook script while processing filenames. (CVE-2013-2088)

Solution

Upgrade to Apache Subversion 1.7.10 or later. If 1.7.x cannot be obtained, 1.6.23 is also patched for these vulnerabilities.

See Also

http://subversion.apache.org/security/CVE-2013-1968-advisory.txt

http://subversion.apache.org/security/CVE-2013-2088-advisory.txt

http://subversion.apache.org/security/CVE-2013-2112-advisory.txt

Plugin Details

Severity: High

ID: 6854

File Name: 6854.prm

Family: Web Servers

Published: 2013/06/04

Modified: 2016/03/18

Dependencies: 8971

Nessus ID: 66890

Risk Information

Risk Factor: High

CVSSv2

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

CVSSv3

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS3#AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS3#E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:apache:subversion

Patch Publication Date: 2013/06/03

Vulnerability Publication Date: 2013/06/03

Reference Information

CVE: CVE-2013-2112, CVE-2013-2088, CVE-2013-1968

BID: 60264, 60265, 60267