SVNParentPath() 内部的客户端可导致 subversion 服务器崩溃。此外，还通过“blame -g”修复了内存不足的情况。已向这些问题分配了 CVE-2010-4539 和 CVE-2010-4644。

来自 Red Hat 安全公告 2011:0258：

更新后的 subversion 程序包修复了三个安全问题，现在可用于 Red Hat Enterprise Linux 6。

Red Hat 安全响应团队已将此更新评级为具有中等安全影响。可从“参考”部分中的 CVE 链接获取针对每个漏洞的通用漏洞评分系统 (CVSS) 基本分数，其给出了详细的严重性等级。

Subversion (SVN) 是一个并行版本控制系统，使一个或多个用户能够协作开发和维护文件及目录的层次结构，同时保留所有更改历史。mod_dav_svn 模块与 Apache HTTP Server 配合使用，以便通过 HTTP 访问 Subversion 存储库。

在 mod_dav_svn 模块中发现了一个访问限制绕过缺陷。
如果将 SVNPathAuthz 指令设置为“short_circuit”，将不实施某些访问规则，因此可能将敏感的存储库数据泄露给远程用户。请注意，SVNPathAuthz 默认设置为“On”。(CVE-2010-3315)

在 Subversion 服务器中发现了服务器端内存泄漏。如果远程恶意用户对特定存储库文件执行“svn blame”或“svn log”操作，可能导致 Subversion 服务器使用大量系统内存。(CVE-2010-4644)

在 mod_dav_svn 模块处理特定请求的方式中发现一个空指针取消引用缺陷。如果远程恶意用户发出特定类型的请求以在启用了 SVNListParentPath 指令的主机上显示 Subversion 存储库集合，可能导致处理此请求的 httpd 进程崩溃。请注意，默认不启用 SVNListParentPath。
(CVE-2010-4539)

所有 Subversion 用户应升级这些更新后的程序包，其中包含用于修正这些问题的向后移植的修补程序。安装更新后的程序包后，必须重新启动 Subversion 服务器才能使更新生效：如果使用 mod_dav_svn，则重新启动 httpd；如果使用 svnserve，则将其重新启动。

An access restriction bypass flaw was found in the mod_dav_svn module.
If the SVNPathAuthz directive was set to 'short_circuit', certain access rules were not enforced, possibly allowing sensitive repository data to be leaked to remote users. Note that SVNPathAuthz is set to 'On' by default. (CVE-2010-3315)

A server-side memory leak was found in the Subversion server. If a malicious, remote user performed 'svn blame' or 'svn log' operations on certain repository files, it could cause the Subversion server to consume a large amount of system memory. (CVE-2010-4644)

A NULL pointer dereference flaw was found in the way the mod_dav_svn module processed certain requests. If a malicious, remote user issued a certain type of request to display a collection of Subversion repositories on a host that has the SVNListParentPath directive enabled, it could cause the httpd process serving the request to crash. Note that SVNListParentPath is not enabled by default.
(CVE-2010-4539)

After installing the updated packages, the Subversion server must be restarted for the update to take effect: restart httpd if you are using mod_dav_svn, or restart svnserve if it is used.

Updated subversion packages that fix two security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes.

A server-side memory leak was found in the Subversion server. If a malicious, remote user performed 'svn blame' or 'svn log' operations on certain repository files, it could cause the Subversion server to consume a large amount of system memory. (CVE-2010-4644)

A NULL pointer dereference flaw was found in the way the mod_dav_svn module (for use with the Apache HTTP Server) processed certain requests. If a malicious, remote user issued a certain type of request to display a collection of Subversion repositories on a host that has the SVNListParentPath directive enabled, it could cause the httpd process serving the request to crash. Note that SVNListParentPath is not enabled by default. (CVE-2010-4539)

All Subversion users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the Subversion server must be restarted for the update to take effect: restart httpd if you are using mod_dav_svn, or restart svnserve if it is used.

The subversion server could be crashed by clients inside SVNParentPath(). Additionally an Out Of Memory condition via 'blame
-g' has been fixed. CVE-2010-4539 and CVE-2010-4644 have been assigned to these issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
75616	openSUSE 安全更新：libsvn_auth_gnome_keyring-1-0 (openSUSE-SU-2011:0136-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	medium
68200	Oracle Linux 6：subversion (ELSA-2011-0258)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	medium
60955	Scientific Linux Security Update : subversion on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
51994	RHEL 5 : subversion (RHSA-2011:0257)	Nessus	Red Hat Local Security Checks	2011/2/16	2021/1/14	medium
53420	CentOS 5 : subversion (CESA-2011:0257)	Nessus	CentOS Local Security Checks	2011/4/15	2021/1/4	medium
53759	openSUSE Security Update : libsvn_auth_gnome_keyring-1-0 (openSUSE-SU-2011:0136-1)	Nessus	SuSE Local Security Checks	2011/5/5	2021/1/14	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium