Several security issues have been found in the server components of the version control system subversion.

  - CVE-2015-3184     Subversion's mod_authz_svn does not properly restrict     anonymous access in some mixed anonymous/authenticated     environments when using Apache httpd 2.4. The result is     that anonymous access may be possible to files for which     only authenticated access should be possible. This issue     does not affect the oldstable distribution (wheezy)     because it only contains Apache httpd 2.2.

  - CVE-2015-3187     Subversion servers, both httpd and svnserve, will reveal     some paths that should be hidden by path-based authz.
    When a node is copied from an unreadable location to a     readable location the unreadable path may be revealed.
    This vulnerablity only reveals the path, it does not     reveal the contents of the path.

subversion was updated to version 1.8.14 to fix two security issues.

These security issues were fixed :

  - CVE-2015-3187: Information leak (only paths) that were     hidden by path-based authz (bsc#939517).

  - CVE-2015-3184: Information leak in mixed     anonymous/authenticated httpd (dav) configurations     (bsc#939514).

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXEA:2018-2733:01 advisory.

  - mod_authz_svn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, when using Apache httpd     2.4.x, does not properly restrict anonymous access, which allows remote anonymous users to read hidden     files via the path name. (CVE-2015-3184)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Subversion reports :

CVE-2015-3184 : Subversion's mod_authz_svn does not properly restrict anonymous access in some mixed anonymous/authenticated environments when using Apache httpd 2.4.

CVE-2015-3187 : Subversion servers, both httpd and svnserve, will reveal some paths that should be hidden by path-based authz.

An assertion failure flaw was found in the way the SVN server processed certain requests with dynamically evaluated revision numbers. A remote attacker could use this flaw to cause the SVN server (both svnserve and httpd with the mod_dav_svn module) to crash.
(CVE-2015-0248)

It was found that the mod_authz_svn module did not properly restrict anonymous access to Subversion repositories under certain configurations when used with Apache httpd 2.4.x. This could allow a user to anonymously access files in a Subversion repository, which should only be accessible to authenticated users. (CVE-2015-3184)

It was found that the mod_dav_svn module did not properly validate the svn:author property of certain requests. An attacker able to create new revisions could use this flaw to spoof the svn:author property.
(CVE-2015-0251)

It was found that when an SVN server (both svnserve and httpd with the mod_dav_svn module) searched the history of a file or a directory, it would disclose its location in the repository if that file or directory was not readable (for example, if it had been moved).
(CVE-2015-3187)

After installing the updated packages, for the update to take effect, you must restart the httpd daemon, if you are using mod_dav_svn, and the svnserve daemon, if you are serving Subversion repositories via the svn:// protocol.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2721-1 advisory.

    It was discovered that the Subversion mod_dav_svn module incorrectly handled REPORT requests for a     resource that does not exist. A remote attacker could use this issue to cause the server to crash,     resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS.
    (CVE-2014-3580)

    It was discovered that the Subversion mod_dav_svn module incorrectly handled requests requiring a lookup     for a virtual transaction name that does not exist. A remote attacker could use this issue to cause the     server to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS.
    (CVE-2014-8108)

    Evgeny Kotkov discovered that the Subversion mod_dav_svn module incorrectly handled large numbers of     REPORT requests. A remote attacker could use this issue to cause the server to crash, resulting in a     denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-0202)

    Evgeny Kotkov discovered that the Subversion mod_dav_svn and svnserve modules incorrectly certain crafted     parameter combinations. A remote attacker could use this issue to cause the server to crash, resulting in     a denial of service. (CVE-2015-0248)

    Ivan Zhakov discovered that the Subversion mod_dav_svn module incorrectly handled crafted v1 HTTP protocol     request sequences. A remote attacker could use this issue to spoof the svn:author property.
    (CVE-2015-0251)

    C. Michael Pilato discovered that the Subversion mod_dav_svn module incorrectly restricted anonymous     access. A remote attacker could use this issue to read hidden files via the path name. This issue only     affected Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-3184)

    C. Michael Pilato discovered that Subversion incorrectly handled path-based authorization. A remote     attacker could use this issue to obtain sensitive path information. (CVE-2015-3187)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apple Xcode installed on the remote Mac OS X host is prior to 7.3. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in Apache Subversion in mod_authz_svn due to a failure to properly restrict anonymous     access. An unauthenticated, remote attacker can exploit this, via a crafted path name, to read hidden     files. (CVE-2015-3184)

  - A flaw exists in Apache Subversion in the svn_repos_trace_node_locations() function that causes the first     readable path to be returned when it encounters an unreadable path when following a node's history. An     authenticated, remote attacker can exploit this to access paths that were intended to be hidden.
    (CVE-2015-3187)

  - Multiple unspecified memory corruption issues exist in otool due to improper validation of user-supplied     input. A local attacker can exploit these to cause a denial of service or to execute arbitrary code.
    (CVE-2016-1765)

It was found that when an SVN server (both svnserve and httpd with the mod_dav_svn module) searched the history of a file or a directory, it would disclose its location in the repository if that file or directory was not readable (for example, if it had been moved).
(CVE-2015-3187)

An integer overflow was discovered allowing remote attackers to execute arbitrary code via an svn:// protocol string, which triggers a heap-based buffer overflow and an out-of-bounds read. (CVE-2015-5259)

It was found that the mod_authz_svn module did not properly restrict anonymous access to Subversion repositories under certain configurations when used with Apache httpd 2.4.x. This could allow a user to anonymously access files in a Subversion repository, which should only be accessible to authenticated users. (CVE-2015-3184)

It was found that the mod_dav_svn module was vulnerable to a remotely triggerable heap-based buffer overflow and out-of-bounds read caused by an integer overflow when parsing skel-encoded request bodies, allowing an attacker with write access to a repository to cause a denial of service attack (on 32-bit or 64-bit servers) or possibly execute arbitrary code (on 32-bit servers only) under the context of the httpd process. (CVE-2015-5343)

ID	Name	Product	Family	Published	Updated	Severity
85354	Debian DSA-3331-1 : subversion - security update	Nessus	Debian Local Security Checks	8/13/2015	1/11/2021	medium
85524	openSUSE Security Update : subversion (openSUSE-2015-549)	Nessus	SuSE Local Security Checks	8/19/2015	1/19/2021	medium
291410	MiracleLinux 7 : subversion-1.7.14-14.el7 (AXEA:2018-2733:01)	Nessus	Miracle Linux Local Security Checks	1/19/2026	1/19/2026	high
85257	FreeBSD : subversion -- multiple vulnerabilities (57bb5e3d-3c4f-11e5-a4d4-001e8c75030d)	Nessus	FreeBSD Local Security Checks	8/7/2015	1/6/2021	medium
85867	Scientific Linux Security Update : subversion on SL7.x x86_64 (20150908)	Nessus	Scientific Linux Local Security Checks	9/9/2015	1/14/2021	medium
85579	Ubuntu 14.04 LTS : Subversion vulnerabilities (USN-2721-1)	Nessus	Ubuntu Local Security Checks	8/21/2015	9/3/2025	high
90148	Apple Xcode < 7.3 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	3/24/2016	5/5/2020	medium
90269	Amazon Linux AMI : mod_dav_svn / subversion (ALAS-2016-676)	Nessus	Amazon Linux Local Security Checks	4/1/2016	4/18/2018	high

Detections

Analytics

Plugins Search

medium

medium

high

medium

medium

high

medium

high