{"id": "MANDRIVA_MDVSA-2013-288.NASL", "bulletinFamily": "scanner", "title": "Mandriva Linux Security Advisory : subversion (MDVSA-2013:288)", "description": "Updated subversion package fixes security vulnerabilities :\n\nmod_dontdothat allows you to block update REPORT requests against\ncertain paths in the repository. It expects the paths in the REPORT\nrequest to be absolute URLs. Serf based clients send relative URLs\ninstead of absolute URLs in many cases. As a result these clients are\nnot blocked as configured by mod_dontdothat (CVE-2013-4505).\n\nWhen SVNAutoversioning is enabled via SVNAutoversioning on, commits\ncan be made by single HTTP requests such as MKCOL and PUT. If\nSubversion is built with assertions enabled any such requests that\nhave non-canonical URLs, such as URLs with a trailing /, may trigger\nan assert. An assert will cause the Apache process to abort\n(CVE-2013-4558).", "published": "2013-12-18T00:00:00", "modified": "2013-12-18T00:00:00", "cvss": {"score": 3.5, "vector": "AV:N/AC:M/Au:S/C:N/I:N/A:P"}, "href": "https://www.tenable.com/plugins/nessus/71508", "reporter": "This script is Copyright (C) 2013-2021 Tenable Network Security, Inc.", "references": ["http://advisories.mageia.org/MGASA-2013-0360.html"], "cvelist": ["CVE-2013-4558", "CVE-2013-4505"], "type": "nessus", "lastseen": "2021-01-07T11:54:26", "edition": 24, "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2013-4505", "CVE-2013-4558"]}, {"type": "openvas", "idList": ["OPENVAS:867116", "OPENVAS:1361412562310806856", "OPENVAS:867129", "OPENVAS:1361412562310867116", "OPENVAS:1361412562310120466", "OPENVAS:1361412562310867129", "OPENVAS:867267", "OPENVAS:1361412562310867267"]}, {"type": "freebsd", "idList": ["E3244A7B-5603-11E3-878D-20CF30E32F6D"]}, {"type": "nessus", "idList": ["OPENSUSE-2013-962.NASL", "SUBVERSION_1_8_5.NASL", "FEDORA_2013-22575.NASL", "SLACKWARE_SSA_2014-058-01.NASL", "FEDORA_2013-22313.NASL", "OPENSUSE-2013-942.NASL", "FEDORA_2013-22208.NASL", "ALA_ALAS-2013-269.NASL", "FREEBSD_PKG_E3244A7B560311E3878D20CF30E32F6D.NASL", "SOLARIS11_SUBVERSION_20140401.NASL"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:30337", "SECURITYVULNS:VULN:13510", "SECURITYVULNS:DOC:30208"]}, {"type": "amazon", "idList": ["ALAS-2013-269"]}, {"type": "fedora", "idList": ["FEDORA:E660E22EE8", "FEDORA:00DAD228C6", "FEDORA:51181228C3"]}, {"type": "slackware", "idList": ["SSA-2014-058-01"]}, {"type": "kaspersky", "idList": ["KLA10069"]}], "modified": "2021-01-07T11:54:26", "rev": 2}, "score": {"value": 5.1, "vector": "NONE", "modified": "2021-01-07T11:54:26", "rev": 2}, "vulnersScore": 5.1}, "sourceData": "#%NASL_MIN_LEVEL 70300\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandriva Linux Security Advisory MDVSA-2013:288. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(71508);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2013-4505\", \"CVE-2013-4558\");\n script_bugtraq_id(63966, 63981);\n script_xref(name:\"MDVSA\", value:\"2013:288\");\n\n script_name(english:\"Mandriva Linux Security Advisory : subversion (MDVSA-2013:288)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Mandriva Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated subversion package fixes security vulnerabilities :\n\nmod_dontdothat allows you to block update REPORT requests against\ncertain paths in the repository. It expects the paths in the REPORT\nrequest to be absolute URLs. Serf based clients send relative URLs\ninstead of absolute URLs in many cases. As a result these clients are\nnot blocked as configured by mod_dontdothat (CVE-2013-4505).\n\nWhen SVNAutoversioning is enabled via SVNAutoversioning on, commits\ncan be made by single HTTP requests such as MKCOL and PUT. If\nSubversion is built with assertions enabled any such requests that\nhave non-canonical URLs, such as URLs with a trailing /, may trigger\nan assert. An assert will cause the Apache process to abort\n(CVE-2013-4558).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://advisories.mageia.org/MGASA-2013-0360.html\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:S/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:apache-mod_dav_svn\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64svn-gnome-keyring0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64svn0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64svnjavahl1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:perl-SVN\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:perl-svn-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:python-svn\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:python-svn-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:ruby-svn\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:ruby-svn-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:subversion\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:subversion-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:subversion-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:subversion-gnome-keyring-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:subversion-server\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:subversion-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:svn-javahl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:business_server:1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/12/17\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/12/18\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"apache-mod_dav_svn-1.7.14-0.1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"lib64svn-gnome-keyring0-1.7.14-0.1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"lib64svn0-1.7.14-0.1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"lib64svnjavahl1-1.7.14-0.1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"perl-SVN-1.7.14-0.1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"perl-svn-devel-1.7.14-0.1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"python-svn-1.7.14-0.1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"python-svn-devel-1.7.14-0.1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"ruby-svn-1.7.14-0.1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"ruby-svn-devel-1.7.14-0.1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"subversion-1.7.14-0.1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"subversion-devel-1.7.14-0.1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"subversion-doc-1.7.14-0.1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"subversion-gnome-keyring-devel-1.7.14-0.1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"subversion-server-1.7.14-0.1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"subversion-tools-1.7.14-0.1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"svn-javahl-1.7.14-0.1.mbs1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_note(port:0, extra:rpm_report_get());\n else security_note(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "naslFamily": "Mandriva Local Security Checks", "pluginID": "71508", "cpe": ["p-cpe:/a:mandriva:linux:subversion", "cpe:/o:mandriva:business_server:1", "p-cpe:/a:mandriva:linux:python-svn-devel", "p-cpe:/a:mandriva:linux:ruby-svn-devel", "p-cpe:/a:mandriva:linux:ruby-svn", "p-cpe:/a:mandriva:linux:apache-mod_dav_svn", "p-cpe:/a:mandriva:linux:subversion-doc", "p-cpe:/a:mandriva:linux:lib64svnjavahl1", "p-cpe:/a:mandriva:linux:subversion-devel", "p-cpe:/a:mandriva:linux:lib64svn-gnome-keyring0", "p-cpe:/a:mandriva:linux:subversion-tools", "p-cpe:/a:mandriva:linux:svn-javahl", "p-cpe:/a:mandriva:linux:subversion-gnome-keyring-devel", "p-cpe:/a:mandriva:linux:perl-svn-devel", "p-cpe:/a:mandriva:linux:python-svn", "p-cpe:/a:mandriva:linux:perl-SVN", "p-cpe:/a:mandriva:linux:lib64svn0", "p-cpe:/a:mandriva:linux:subversion-server"], "scheme": null}

{"cve": [{"lastseen": "2020-10-03T12:46:04", "description": "The is_this_legal function in mod_dontdothat for Apache Subversion 1.4.0 through 1.7.13 and 1.8.0 through 1.8.4 allows remote attackers to bypass intended access restrictions and possibly cause a denial of service (resource consumption) via a relative URL in a REPORT request.", "edition": 3, "cvss3": {}, "published": "2013-12-07T20:55:00", "title": "CVE-2013-4505", "type": "cve", "cwe": ["CWE-264"], "bulletinFamily": "NVD", "cvss2": {"severity": "LOW", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4505"], "modified": "2013-12-20T04:36:00", "cpe": ["cpe:/a:apache:subversion:1.7.2", "cpe:/a:apache:subversion:1.6.7", "cpe:/a:apache:subversion:1.4.3", "cpe:/a:apache:subversion:1.8.1", "cpe:/a:apache:subversion:1.5.5", "cpe:/a:apache:subversion:1.5.4", "cpe:/a:apache:subversion:1.6.20", "cpe:/a:apache:subversion:1.5.2", "cpe:/a:apache:subversion:1.7.3", "cpe:/a:apache:subversion:1.6.18", "cpe:/a:apache:subversion:1.5.6", "cpe:/a:apache:subversion:1.7.6", "cpe:/a:apache:subversion:1.7.10", "cpe:/a:apache:subversion:1.6.21", "cpe:/a:apache:subversion:1.5.1", "cpe:/a:apache:subversion:1.6.0", "cpe:/a:apache:subversion:1.5.7", "cpe:/a:apache:subversion:1.4.1", "cpe:/a:apache:subversion:1.7.4", "cpe:/a:apache:subversion:1.4.5", "cpe:/a:apache:subversion:1.6.16", "cpe:/a:apache:subversion:1.6.4", "cpe:/a:apache:subversion:1.6.23", "cpe:/a:apache:subversion:1.6.2", "cpe:/a:apache:subversion:1.6.19", "cpe:/a:apache:subversion:1.6.13", "cpe:/a:apache:subversion:1.5.0", "cpe:/a:apache:subversion:1.7.5", "cpe:/a:apache:subversion:1.5.8", "cpe:/a:apache:subversion:1.6.8", "cpe:/a:apache:subversion:1.7.11", "cpe:/a:apache:subversion:1.7.0", "cpe:/a:apache:subversion:1.6.15", "cpe:/a:apache:subversion:1.4.0", "cpe:/a:apache:subversion:1.7.8", "cpe:/a:apache:subversion:1.5.3", "cpe:/a:apache:subversion:1.6.6", "cpe:/a:apache:mod_dontdothat:-", "cpe:/a:apache:subversion:1.6.10", "cpe:/a:apache:subversion:1.4.2", "cpe:/a:apache:subversion:1.7.12", "cpe:/a:apache:subversion:1.6.1", "cpe:/a:apache:subversion:1.6.3", "cpe:/a:apache:subversion:1.4.4", "cpe:/a:apache:subversion:1.7.7", "cpe:/a:apache:subversion:1.6.5", "cpe:/a:apache:subversion:1.7.1", "cpe:/a:apache:subversion:1.6.12", "cpe:/a:apache:subversion:1.4.6", "cpe:/a:apache:subversion:1.6.17", "cpe:/a:apache:subversion:1.6.11", "cpe:/a:apache:subversion:1.6.9", "cpe:/a:apache:subversion:1.7.9", "cpe:/a:apache:subversion:1.6.14"], "id": "CVE-2013-4505", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4505", "cvss": {"score": 2.6, "vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:a:apache:subversion:1.6.13:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.7.12:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.7.4:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.6.17:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.7.10:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.6.16:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.6.20:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.6.12:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.8.1:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.7.3:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.7.11:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.6.14:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.5.8:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.6.5:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.5.4:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.6.4:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.6.10:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.6.6:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.7.2:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.6.21:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.5.3:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.6.7:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.5.5:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.6.23:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.5.7:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.6.11:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.7.9:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.6.19:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.7.5:*:*:*:*:*:*:*", "cpe:2.3:a:apache:mod_dontdothat:-:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.6.15:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.7.8:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.6.18:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.7.6:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.5.6:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.7.0:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.7.7:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.7.1:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.6.8:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.6.9:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.6.3:*:*:*:*:*:*:*"]}, {"lastseen": "2020-10-03T12:46:05", "description": "The get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1 through 1.8.4, when built with assertions enabled and SVNAutoversioning is enabled, allows remote attackers to cause a denial of service (assertion failure and Apache process abort) via a non-canonical URL in a request, as demonstrated using a trailing /.", "edition": 3, "cvss3": {}, "published": "2013-12-07T20:55:00", "title": "CVE-2013-4558", "type": "cve", "cwe": ["CWE-20"], "bulletinFamily": "NVD", "cvss2": {"severity": "LOW", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 3.5, "vectorString": "AV:N/AC:M/Au:S/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4558"], "modified": "2013-12-20T04:36:00", "cpe": ["cpe:/a:apache:subversion:1.8.1", "cpe:/a:apache:mod_dav_svn:-", "cpe:/a:apache:subversion:1.8.3", "cpe:/a:apache:subversion:1.8.2", "cpe:/a:apache:subversion:1.7.11", "cpe:/a:apache:subversion:1.7.12", "cpe:/a:apache:subversion:1.8.4", "cpe:/a:apache:subversion:1.7.13"], "id": "CVE-2013-4558", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4558", "cvss": {"score": 3.5, "vector": "AV:N/AC:M/Au:S/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:a:apache:subversion:1.7.12:*:*:*:*:*:*:*", "cpe:2.3:a:apache:mod_dav_svn:-:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.8.4:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.8.1:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.7.11:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.8.2:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.8.3:*:*:*:*:*:*:*", "cpe:2.3:a:apache:subversion:1.7.13:*:*:*:*:*:*:*"]}], "openvas": [{"lastseen": "2018-01-26T11:09:39", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-4558", "CVE-2013-4505"], "description": "Check for the Version of subversion", "modified": "2018-01-25T00:00:00", "published": "2013-12-17T00:00:00", "id": "OPENVAS:867129", "href": "http://plugins.openvas.org/nasl.php?oid=867129", "type": "openvas", "title": "Fedora Update for subversion FEDORA-2013-22313", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for subversion FEDORA-2013-22313\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2013 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\n\nif(description)\n{\n script_id(867129);\n script_version(\"$Revision: 8526 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-01-25 07:57:37 +0100 (Thu, 25 Jan 2018) $\");\n script_tag(name:\"creation_date\", value:\"2013-12-17 11:46:54 +0530 (Tue, 17 Dec 2013)\");\n script_cve_id(\"CVE-2013-4505\", \"CVE-2013-4558\");\n script_tag(name:\"cvss_base\", value:\"3.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:S/C:N/I:N/A:P\");\n script_name(\"Fedora Update for subversion FEDORA-2013-22313\");\n\n tag_insight = \"Subversion is a concurrent version control system which enables one\nor more users to collaborate in developing and maintaining a\nhierarchy of files and directories while keeping a history of all\nchanges. Subversion only stores the differences between versions,\ninstead of every complete file. Subversion is intended to be a\ncompelling replacement for CVS.\n\";\n\n tag_affected = \"subversion on Fedora 18\";\n\n tag_solution = \"Please Install the Updated Packages.\";\n\n\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name: \"FEDORA\", value: \"2013-22313\");\n script_xref(name: \"URL\" , value: \"https://lists.fedoraproject.org/pipermail/package-announce/2013-December/123378.html\");\n script_tag(name: \"summary\" , value: \"Check for the Version of subversion\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2013 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC18\")\n{\n\n if ((res = isrpmvuln(pkg:\"subversion\", rpm:\"subversion~1.7.14~1.fc18\", rls:\"FC18\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 3.5, "vector": "AV:NETWORK/AC:MEDIUM/Au:SINGLE_INSTANCE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-02-06T13:10:07", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-4558", "CVE-2013-4505"], "description": "Check for the Version of subversion", "modified": "2018-02-05T00:00:00", "published": "2013-12-17T00:00:00", "id": "OPENVAS:867116", "href": "http://plugins.openvas.org/nasl.php?oid=867116", "type": "openvas", "title": "Fedora Update for subversion FEDORA-2013-22208", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for subversion FEDORA-2013-22208\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2013 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\n\nif(description)\n{\n script_id(867116);\n script_version(\"$Revision: 8672 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-02-05 17:39:18 +0100 (Mon, 05 Feb 2018) $\");\n script_tag(name:\"creation_date\", value:\"2013-12-17 11:38:48 +0530 (Tue, 17 Dec 2013)\");\n script_cve_id(\"CVE-2013-4505\", \"CVE-2013-4558\");\n script_tag(name:\"cvss_base\", value:\"3.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:S/C:N/I:N/A:P\");\n script_name(\"Fedora Update for subversion FEDORA-2013-22208\");\n\n tag_insight = \"Subversion is a concurrent version control system which enables one\nor more users to collaborate in developing and maintaining a\nhierarchy of files and directories while keeping a history of all\nchanges. Subversion only stores the differences between versions,\ninstead of every complete file. Subversion is intended to be a\ncompelling replacement for CVS.\n\";\n\n tag_affected = \"subversion on Fedora 19\";\n\n tag_solution = \"Please Install the Updated Packages.\";\n\n\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name: \"FEDORA\", value: \"2013-22208\");\n script_xref(name: \"URL\" , value: \"https://lists.fedoraproject.org/pipermail/package-announce/2013-December/123377.html\");\n script_tag(name: \"summary\" , value: \"Check for the Version of subversion\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2013 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC19\")\n{\n\n if ((res = isrpmvuln(pkg:\"subversion\", rpm:\"subversion~1.7.14~1.fc19\", rls:\"FC19\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}", "cvss": {"score": 3.5, "vector": "AV:NETWORK/AC:MEDIUM/Au:SINGLE_INSTANCE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2019-05-29T18:38:03", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-4558", "CVE-2013-4505"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2013-12-17T00:00:00", "id": "OPENVAS:1361412562310867116", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310867116", "type": "openvas", "title": "Fedora Update for subversion FEDORA-2013-22208", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for subversion FEDORA-2013-22208\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2013 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.867116\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2013-12-17 11:38:48 +0530 (Tue, 17 Dec 2013)\");\n script_cve_id(\"CVE-2013-4505\", \"CVE-2013-4558\");\n script_tag(name:\"cvss_base\", value:\"3.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:S/C:N/I:N/A:P\");\n script_name(\"Fedora Update for subversion FEDORA-2013-22208\");\n\n\n script_tag(name:\"affected\", value:\"subversion on Fedora 19\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"FEDORA\", value:\"2013-22208\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2013-December/123377.html\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'subversion'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2013 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC19\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC19\")\n{\n\n if ((res = isrpmvuln(pkg:\"subversion\", rpm:\"subversion~1.7.14~1.fc19\", rls:\"FC19\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}", "cvss": {"score": 3.5, "vector": "AV:N/AC:M/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2019-05-29T18:38:11", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-4558", "CVE-2013-4505"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2013-12-17T00:00:00", "id": "OPENVAS:1361412562310867129", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310867129", "type": "openvas", "title": "Fedora Update for subversion FEDORA-2013-22313", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for subversion FEDORA-2013-22313\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2013 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.867129\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2013-12-17 11:46:54 +0530 (Tue, 17 Dec 2013)\");\n script_cve_id(\"CVE-2013-4505\", \"CVE-2013-4558\");\n script_tag(name:\"cvss_base\", value:\"3.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:S/C:N/I:N/A:P\");\n script_name(\"Fedora Update for subversion FEDORA-2013-22313\");\n\n\n script_tag(name:\"affected\", value:\"subversion on Fedora 18\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"FEDORA\", value:\"2013-22313\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2013-December/123378.html\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'subversion'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2013 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC18\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC18\")\n{\n\n if ((res = isrpmvuln(pkg:\"subversion\", rpm:\"subversion~1.7.14~1.fc18\", rls:\"FC18\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 3.5, "vector": "AV:N/AC:M/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2017-07-25T10:48:43", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-4558", "CVE-2013-4505"], "description": "Check for the Version of subversion", "modified": "2017-07-10T00:00:00", "published": "2014-02-05T00:00:00", "id": "OPENVAS:867267", "href": "http://plugins.openvas.org/nasl.php?oid=867267", "type": "openvas", "title": "Fedora Update for subversion FEDORA-2013-22575", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for subversion FEDORA-2013-22575\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\n\nif(description)\n{\n script_id(867267);\n script_version(\"$Revision: 6629 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 08:33:41 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2014-02-05 09:31:21 +0530 (Wed, 05 Feb 2014)\");\n script_cve_id(\"CVE-2013-4505\", \"CVE-2013-4558\");\n script_tag(name:\"cvss_base\", value:\"3.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:S/C:N/I:N/A:P\");\n script_name(\"Fedora Update for subversion FEDORA-2013-22575\");\n\n tag_insight = \"Subversion is a concurrent version control system which enables one\nor more users to collaborate in developing and maintaining a\nhierarchy of files and directories while keeping a history of all\nchanges. Subversion only stores the differences between versions,\ninstead of every complete file. Subversion is intended to be a\ncompelling replacement for CVS.\n\";\n\n tag_affected = \"subversion on Fedora 20\";\n\n tag_solution = \"Please Install the Updated Packages.\";\n\n\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name: \"FEDORA\", value: \"2013-22575\");\n script_xref(name: \"URL\" , value: \"https://lists.fedoraproject.org/pipermail/package-announce/2013-December/125452.html\");\n script_summary(\"Check for the Version of subversion\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC20\")\n{\n\n if ((res = isrpmvuln(pkg:\"subversion\", rpm:\"subversion~1.8.5~2.fc20\", rls:\"FC20\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}", "cvss": {"score": 3.5, "vector": "AV:NETWORK/AC:MEDIUM/Au:SINGLE_INSTANCE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2019-05-29T18:37:27", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-4558", "CVE-2013-4505"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2014-02-05T00:00:00", "id": "OPENVAS:1361412562310867267", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310867267", "type": "openvas", "title": "Fedora Update for subversion FEDORA-2013-22575", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for subversion FEDORA-2013-22575\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.867267\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2014-02-05 09:31:21 +0530 (Wed, 05 Feb 2014)\");\n script_cve_id(\"CVE-2013-4505\", \"CVE-2013-4558\");\n script_tag(name:\"cvss_base\", value:\"3.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:S/C:N/I:N/A:P\");\n script_name(\"Fedora Update for subversion FEDORA-2013-22575\");\n script_tag(name:\"affected\", value:\"subversion on Fedora 20\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"FEDORA\", value:\"2013-22575\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2013-December/125452.html\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'subversion'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC20\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC20\")\n{\n\n if ((res = isrpmvuln(pkg:\"subversion\", rpm:\"subversion~1.8.5~2.fc20\", rls:\"FC20\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}", "cvss": {"score": 3.5, "vector": "AV:N/AC:M/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2020-03-17T23:01:28", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-4558", "CVE-2013-4505"], "description": "The remote host is missing an update announced via the referenced Security Advisory.", "modified": "2020-03-13T00:00:00", "published": "2015-09-08T00:00:00", "id": "OPENVAS:1361412562310120466", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310120466", "type": "openvas", "title": "Amazon Linux: Security Advisory (ALAS-2013-269)", "sourceData": "# Copyright (C) 2015 Eero Volotinen\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) of their respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.120466\");\n script_version(\"2020-03-13T13:19:50+0000\");\n script_tag(name:\"creation_date\", value:\"2015-09-08 13:27:03 +0200 (Tue, 08 Sep 2015)\");\n script_tag(name:\"last_modification\", value:\"2020-03-13 13:19:50 +0000 (Fri, 13 Mar 2020)\");\n script_name(\"Amazon Linux: Security Advisory (ALAS-2013-269)\");\n script_tag(name:\"insight\", value:\"The is_this_legal function in mod_dontdothat for Apache Subversion 1.4.0 through 1.7.13 and 1.8.0 through 1.8.4 allows remote attackers to bypass intended access restrictions and possibly cause a denial of service (resource consumption) via a relative URL in a REPORT request.The get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1 through 1.8.4, when built with assertions enabled and SVNAutoversioning is enabled, allows remote attackers to cause a denial of service (assertion failure and Apache process abort) via a non-canonical URL in a request, as demonstrated using a trailing /.\");\n script_tag(name:\"solution\", value:\"Run yum update subversion to update your system.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"URL\", value:\"https://alas.aws.amazon.com/ALAS-2013-269.html\");\n script_cve_id(\"CVE-2013-4505\", \"CVE-2013-4558\");\n script_tag(name:\"cvss_base\", value:\"3.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:S/C:N/I:N/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/amazon_linux\", \"ssh/login/release\");\n script_category(ACT_GATHER_INFO);\n script_tag(name:\"summary\", value:\"The remote host is missing an update announced via the referenced Security Advisory.\");\n script_copyright(\"Copyright (C) 2015 Eero Volotinen\");\n script_family(\"Amazon Linux Local Security Checks\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"AMAZON\") {\n if(!isnull(res = isrpmvuln(pkg:\"subversion-ruby\", rpm:\"subversion-ruby~1.7.14~1.36.amzn1\", rls:\"AMAZON\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"subversion\", rpm:\"subversion~1.7.14~1.36.amzn1\", rls:\"AMAZON\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"subversion-javahl\", rpm:\"subversion-javahl~1.7.14~1.36.amzn1\", rls:\"AMAZON\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"subversion-tools\", rpm:\"subversion-tools~1.7.14~1.36.amzn1\", rls:\"AMAZON\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"subversion-libs\", rpm:\"subversion-libs~1.7.14~1.36.amzn1\", rls:\"AMAZON\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"subversion-devel\", rpm:\"subversion-devel~1.7.14~1.36.amzn1\", rls:\"AMAZON\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"mod_dav_svn\", rpm:\"mod_dav_svn~1.7.14~1.36.amzn1\", rls:\"AMAZON\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"subversion-perl\", rpm:\"subversion-perl~1.7.14~1.36.amzn1\", rls:\"AMAZON\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"subversion-python\", rpm:\"subversion-python~1.7.14~1.36.amzn1\", rls:\"AMAZON\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"subversion-debuginfo\", rpm:\"subversion-debuginfo~1.7.14~1.36.amzn1\", rls:\"AMAZON\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 3.5, "vector": "AV:N/AC:M/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2019-05-29T18:35:37", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-4505"], "description": "This host is installed with Apache Subversion\n and is prone to denial of service vulnerability.", "modified": "2018-10-25T00:00:00", "published": "2016-02-08T00:00:00", "id": "OPENVAS:1361412562310806856", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310806856", "type": "openvas", "title": "Apache Subversion Denial Of Service Vulnerability -01 Feb16", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_apache_subversion_dos_vuln01_feb16.nasl 12096 2018-10-25 12:26:02Z asteins $\n#\n# Apache Subversion Denial Of Service Vulnerability -01 Feb16\n#\n# Authors:\n# Kashinath T <tkashinath@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:apache:subversion\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.806856\");\n script_version(\"$Revision: 12096 $\");\n script_cve_id(\"CVE-2013-4505\");\n script_bugtraq_id(63966);\n script_tag(name:\"cvss_base\", value:\"2.6\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:H/Au:N/C:N/I:N/A:P\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-25 14:26:02 +0200 (Thu, 25 Oct 2018) $\");\n script_tag(name:\"creation_date\", value:\"2016-02-08 18:19:08 +0530 (Mon, 08 Feb 2016)\");\n script_tag(name:\"qod_type\", value:\"remote_banner_unreliable\");\n script_name(\"Apache Subversion Denial Of Service Vulnerability -01 Feb16\");\n\n script_tag(name:\"summary\", value:\"This host is installed with Apache Subversion\n and is prone to denial of service vulnerability.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"The flaw is due to the 'is_this_legal()'\n function in mod_dontdothat does not restrict requests from serf based\n clients.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow remote\n attacker to cause a denial of service or bypass intended access restriction.\");\n\n script_tag(name:\"affected\", value:\"Apache Subversion 1.4.0 through\n 1.7.13 and 1.8.0 through 1.8.4\");\n\n script_tag(name:\"solution\", value:\"Upgrade to version 1.7.14, or 1.8.5 or later.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_xref(name:\"URL\", value:\"https://subversion.apache.org/security/CVE-2013-4505-advisory.txt\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Denial of Service\");\n script_dependencies(\"gb_subversion_remote_detect.nasl\");\n script_mandatory_keys(\"Subversion/installed\");\n script_require_ports(\"Services/www\", 3690);\n exit(0);\n}\n\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif(!http_port = get_app_port(cpe:CPE)){\n exit(0);\n}\n\nif(!subver = get_app_version(cpe:CPE, port:http_port)){\n exit(0);\n}\n\nif(subver =~ \"^(1\\.8)\")\n{\n if(version_is_less(version:subver, test_version:\"1.8.5\"))\n {\n report = report_fixed_ver( installed_version:subver, fixed_version:\"1.8.5\" );\n security_message(data:report, port:http_port);\n exit(0);\n }\n}\n\nelse if(version_in_range(version:subver, test_version:\"1.4.0\", test_version2:\"1.7.13\"))\n{\n report = report_fixed_ver( installed_version:subver, fixed_version:\"1.7.14\" );\n security_message(data:report, port:http_port);\n exit(0);\n}\n", "cvss": {"score": 2.6, "vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P"}}], "freebsd": [{"lastseen": "2019-05-29T18:33:32", "bulletinFamily": "unix", "cvelist": ["CVE-2013-4558", "CVE-2013-4505"], "description": "\nSubversion Project reports:\n\nmod_dontdothat does not restrict requests from serf based clients\nmod_dontdothat allows you to block update REPORT requests against certain\n\t paths in the repository. It expects the paths in the REPORT request\n\t to be absolute URLs. Serf based clients send relative URLs instead\n\t of absolute URLs in many cases. As a result these clients are not blocked\n\t as configured by mod_dontdothat.\nmod_dav_svn assertion triggered by non-canonical URLs in autoversioning commits\nWhen SVNAutoversioning is enabled via SVNAutoversioning on\n\t commits can be made by single HTTP requests such as MKCOL and\n\t PUT. If Subversion is built with assertions enabled any such\n\t requests that have non-canonical URLs, such as URLs with a\n\t trailing /, may trigger an assert. An assert will cause the\n\t Apache process to abort.\n\n", "edition": 4, "modified": "2013-11-15T00:00:00", "published": "2013-11-15T00:00:00", "id": "E3244A7B-5603-11E3-878D-20CF30E32F6D", "href": "https://vuxml.freebsd.org/freebsd/e3244a7b-5603-11e3-878d-20cf30e32f6d.html", "title": "subversion -- multiple vulnerabilities", "type": "freebsd", "cvss": {"score": 3.5, "vector": "AV:N/AC:M/Au:S/C:N/I:N/A:P"}}], "securityvulns": [{"lastseen": "2018-08-31T11:10:50", "bulletinFamily": "software", "cvelist": ["CVE-2013-4558", "CVE-2013-4505"], "description": "\r\n\r\n-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA1\r\n\r\n _______________________________________________________________________\r\n\r\n Mandriva Linux Security Advisory MDVSA-2013:288\r\n http://www.mandriva.com/en/support/security/\r\n _______________________________________________________________________\r\n\r\n Package : subversion\r\n Date : December 17, 2013\r\n Affected: Business Server 1.0, Enterprise Server 5.0\r\n _______________________________________________________________________\r\n\r\n Problem Description:\r\n\r\n Updated subversion package fixes security vulnerabilities:\r\n \r\n mod_dontdothat allows you to block update REPORT requests against\r\n certain paths in the repository. It expects the paths in the REPORT\r\n request to be absolute URLs. Serf based clients send relative URLs\r\n instead of absolute URLs in many cases. As a result these clients\r\n are not blocked as configured by mod_dontdothat &#40;CVE-2013-4505&#41;.\r\n \r\n When SVNAutoversioning is enabled via SVNAutoversioning on,\r\n commits can be made by single HTTP requests such as MKCOL and PUT.\r\n If Subversion is built with assertions enabled any such requests\r\n that have non-canonical URLs, such as URLs with a trailing /, may\r\n trigger an assert. An assert will cause the Apache process to abort\r\n &#40;CVE-2013-4558&#41;.\r\n _______________________________________________________________________\r\n\r\n References:\r\n\r\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4505\r\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4558\r\n http://advisories.mageia.org/MGASA-2013-0360.html\r\n _______________________________________________________________________\r\n\r\n Updated Packages:\r\n\r\n Mandriva Enterprise Server 5:\r\n 1d62fa579ffae8bd706142dad45105da mes5/i586/apache-mod_dav_svn-1.7.14-0.1mdvmes5.2.i586.rpm\r\n 90d784c463acf8b78c1c691b2f30d6dd mes5/i586/libsvn0-1.7.14-0.1mdvmes5.2.i586.rpm\r\n c47b980a3ea89f15b8619d253d8f23f4 mes5/i586/libsvnjavahl1-1.7.14-0.1mdvmes5.2.i586.rpm\r\n 62a6b7850e09694fdfc0478a96e2642a mes5/i586/perl-SVN-1.7.14-0.1mdvmes5.2.i586.rpm\r\n a38c85d2badb6f099d1578d27c81ccb3 mes5/i586/perl-svn-devel-1.7.14-0.1mdvmes5.2.i586.rpm\r\n dbda83b4ca0fd7594357686a512a9366 mes5/i586/python-svn-1.7.14-0.1mdvmes5.2.i586.rpm\r\n 9f825413b80cf29fe2ba78a94f7d64bb mes5/i586/python-svn-devel-1.7.14-0.1mdvmes5.2.i586.rpm\r\n 308adec20a31c7dd0c6cf69c43624e81 mes5/i586/ruby-svn-1.7.14-0.1mdvmes5.2.i586.rpm\r\n 3158f991bd283c715954591bcad317c8 mes5/i586/ruby-svn-devel-1.7.14-0.1mdvmes5.2.i586.rpm\r\n 12692ba193dec95fff2f0d54a9dceb85 mes5/i586/subversion-1.7.14-0.1mdvmes5.2.i586.rpm\r\n 15dec4d935c6c0dcb27133d041d6f251 mes5/i586/subversion-devel-1.7.14-0.1mdvmes5.2.i586.rpm\r\n 6a244097644da7b883f4d9728859f54e mes5/i586/subversion-doc-1.7.14-0.1mdvmes5.2.i586.rpm\r\n 7c8e22b78d0e37af09e566fe84a6f72e mes5/i586/subversion-server-1.7.14-0.1mdvmes5.2.i586.rpm\r\n 42c72886b4f762de675423647fbd4d98 mes5/i586/subversion-tools-1.7.14-0.1mdvmes5.2.i586.rpm\r\n 5dc67eac926230ccf2cf8f6ad56ee711 mes5/i586/svn-javahl-1.7.14-0.1mdvmes5.2.i586.rpm \r\n 7201e07969effc89b5f05e14f02a3dbf mes5/SRPMS/subversion-1.7.14-0.1mdvmes5.2.src.rpm\r\n\r\n Mandriva Enterprise Server 5/X86_64:\r\n 58344ddf6bdf2e082fc9eb9c370c1d6c mes5/x86_64/apache-mod_dav_svn-1.7.14-0.1mdvmes5.2.x86_64.rpm\r\n ba396e7cc6a0b57a60d4328bf9f4e4d2 mes5/x86_64/lib64svn0-1.7.14-0.1mdvmes5.2.x86_64.rpm\r\n 873f5a1f6aa95d2bf72696dbb871fefe mes5/x86_64/lib64svnjavahl1-1.7.14-0.1mdvmes5.2.x86_64.rpm\r\n 6fc320c4c8c01a1099cd6cdfaaf0a821 mes5/x86_64/perl-SVN-1.7.14-0.1mdvmes5.2.x86_64.rpm\r\n 69ddd7592494175520da5ad5341e1fc9 mes5/x86_64/perl-svn-devel-1.7.14-0.1mdvmes5.2.x86_64.rpm\r\n 9ee72e400941c6e6187116107da5899a mes5/x86_64/python-svn-1.7.14-0.1mdvmes5.2.x86_64.rpm\r\n 1797db04f38985ef088ec2564b04029d mes5/x86_64/python-svn-devel-1.7.14-0.1mdvmes5.2.x86_64.rpm\r\n 18ee8cf84ee12d32f3a7419a03704316 mes5/x86_64/ruby-svn-1.7.14-0.1mdvmes5.2.x86_64.rpm\r\n 06c6c293e7f27f0747c1253a5906ff31 mes5/x86_64/ruby-svn-devel-1.7.14-0.1mdvmes5.2.x86_64.rpm\r\n f797fd2bdb68d576bfea93bc03dc4a76 mes5/x86_64/subversion-1.7.14-0.1mdvmes5.2.x86_64.rpm\r\n 338eab05e30504debf272a51d72607c3 mes5/x86_64/subversion-devel-1.7.14-0.1mdvmes5.2.x86_64.rpm\r\n 74bac1ee842f300896bb58c017b39223 mes5/x86_64/subversion-doc-1.7.14-0.1mdvmes5.2.x86_64.rpm\r\n 25f6cd72c7fce5416af388218e221957 mes5/x86_64/subversion-server-1.7.14-0.1mdvmes5.2.x86_64.rpm\r\n 0ca18c4790cf3220833b68a0a04642b6 mes5/x86_64/subversion-tools-1.7.14-0.1mdvmes5.2.x86_64.rpm\r\n f36cf1106c787f0a1732e4f1b27d151a mes5/x86_64/svn-javahl-1.7.14-0.1mdvmes5.2.x86_64.rpm \r\n 7201e07969effc89b5f05e14f02a3dbf mes5/SRPMS/subversion-1.7.14-0.1mdvmes5.2.src.rpm\r\n\r\n Mandriva Business Server 1/X86_64:\r\n 8eaa5477089468e118b8e3e37fdfa136 mbs1/x86_64/apache-mod_dav_svn-1.7.14-0.1.mbs1.x86_64.rpm\r\n 1e213dc581bfc397f250c0d830969cea mbs1/x86_64/lib64svn0-1.7.14-0.1.mbs1.x86_64.rpm\r\n 8bf03ee5f00dc27844b27887dd69874b mbs1/x86_64/lib64svn-gnome-keyring0-1.7.14-0.1.mbs1.x86_64.rpm\r\n a445a790fa679c1336a76455823a71f4 mbs1/x86_64/lib64svnjavahl1-1.7.14-0.1.mbs1.x86_64.rpm\r\n c72a3886afb0fd0b4442678fba184f7b mbs1/x86_64/perl-SVN-1.7.14-0.1.mbs1.x86_64.rpm\r\n 0ec8baf5d59f783eb597dc56b02eb443 mbs1/x86_64/perl-svn-devel-1.7.14-0.1.mbs1.x86_64.rpm\r\n 75a468494a343b9ad30f50daf9ff8bae mbs1/x86_64/python-svn-1.7.14-0.1.mbs1.x86_64.rpm\r\n 6acf2fc86952e7ff6f80249efa3a2b85 mbs1/x86_64/python-svn-devel-1.7.14-0.1.mbs1.x86_64.rpm\r\n 5968e570d367b5f1108ddfbb68919ecd mbs1/x86_64/ruby-svn-1.7.14-0.1.mbs1.x86_64.rpm\r\n 9409c0f3a3609e4828fbebf663305ee5 mbs1/x86_64/ruby-svn-devel-1.7.14-0.1.mbs1.x86_64.rpm\r\n 64a752059f681dad3d0eee9a08842574 mbs1/x86_64/subversion-1.7.14-0.1.mbs1.x86_64.rpm\r\n 9ac971374394757e942afd4f7e58735c mbs1/x86_64/subversion-devel-1.7.14-0.1.mbs1.x86_64.rpm\r\n 5c2675975cd738271399170583c1bc93 mbs1/x86_64/subversion-doc-1.7.14-0.1.mbs1.x86_64.rpm\r\n 4cfccaa84ed2fe9b6e2c2dee34b20c30 mbs1/x86_64/subversion-gnome-keyring-devel-1.7.14-0.1.mbs1.x86_64.rpm\r\n 12ab8392f8eeb1d803284e58554337af mbs1/x86_64/subversion-server-1.7.14-0.1.mbs1.x86_64.rpm\r\n d5d76797698ab08ccffed5e75f89c317 mbs1/x86_64/subversion-tools-1.7.14-0.1.mbs1.x86_64.rpm\r\n 8573ae56f5f3289d2cce2c56d3f60f53 mbs1/x86_64/svn-javahl-1.7.14-0.1.mbs1.x86_64.rpm \r\n f0dae800b549b3d4e40e7f7b497b37b6 mbs1/SRPMS/subversion-1.7.14-0.1.mbs1.src.rpm\r\n _______________________________________________________________________\r\n\r\n To upgrade automatically use MandrivaUpdate or urpmi. The verification\r\n of md5 checksums and GPG signatures is performed automatically for you.\r\n\r\n All packages are signed by Mandriva for security. You can obtain the\r\n GPG public key of the Mandriva Security Team by executing:\r\n\r\n gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98\r\n\r\n You can view other update advisories for Mandriva Linux at:\r\n\r\n http://www.mandriva.com/en/support/security/advisories/\r\n\r\n If you want to report vulnerabilities, please contact\r\n\r\n security_&#40;at&#41;_mandriva.com\r\n _______________________________________________________________________\r\n\r\n Type Bits/KeyID Date User ID\r\n pub 1024D/22458A98 2000-07-10 Mandriva Security Team\r\n &lt;security*mandriva.com&gt;\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1.4.12 &#40;GNU/Linux&#41;\r\n\r\niD8DBQFSsEzymqjQ0CJFipgRAvIfAJ9DMlIqd+FYAkiAr13GioFFbiKO5wCglpaQ\r\neArXx+wROjIIeYmUpmpyvM0=\r\n=L3Es\r\n-----END PGP SIGNATURE-----\r\n", "edition": 1, "modified": "2014-01-09T00:00:00", "published": "2014-01-09T00:00:00", "id": "SECURITYVULNS:DOC:30208", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:30208", "title": "[ MDVSA-2013:288 ] subversion", "type": "securityvulns", "cvss": {"score": 3.5, "vector": "AV:NETWORK/AC:MEDIUM/Au:SINGLE_INSTANCE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-08-31T11:10:50", "bulletinFamily": "software", "cvelist": ["CVE-2014-0032", "CVE-2013-4558", "CVE-2013-4505"], "description": "\r\n\r\n\r\n-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA1\r\n\r\n[slackware-security] subversion &#40;SSA:2014-058-01&#41;\r\n\r\nNew subversion packages are available for Slackware 14.0, 14.1, and -current to\r\nfix denial-of-service issues.\r\n\r\n\r\nHere are the details from the Slackware 14.1 ChangeLog:\r\n+--------------------------+\r\npatches/packages/subversion-1.7.16-i486-1_slack14.1.txz: Upgraded.\r\n Fix denial of service bugs.\r\n For more information, see:\r\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4505\r\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4558\r\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0032\r\n &#40;* Security fix *&#41;\r\n+--------------------------+\r\n\r\n\r\nWhere to find the new packages:\r\n+-----------------------------+\r\n\r\nThanks to the friendly folks at the OSU Open Source Lab\r\n&#40;http://osuosl.org&#41; for donating FTP and rsync hosting\r\nto the Slackware project! \r\n\r\nAlso see the &quot;Get Slack&quot; section on http://slackware.com for\r\nadditional mirror sites near you.\r\n\r\nUpdated package for Slackware 14.0:\r\nftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/subversion-1.7.16-i486-1_slack14.0.txz\r\n\r\nUpdated package for Slackware x86_64 14.0:\r\nftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/subversion-1.7.16-x86_64-1_slack14.0.txz\r\n\r\nUpdated package for Slackware 14.1:\r\nftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/subversion-1.7.16-i486-1_slack14.1.txz\r\n\r\nUpdated package for Slackware x86_64 14.1:\r\nftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/subversion-1.7.16-x86_64-1_slack14.1.txz\r\n\r\nUpdated package for Slackware -current:\r\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/d/subversion-1.7.16-i486-1.txz\r\n\r\nUpdated package for Slackware x86_64 -current:\r\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/d/subversion-1.7.16-x86_64-1.txz\r\n\r\n\r\nMD5 signatures:\r\n+-------------+\r\n\r\nSlackware 14.0 package:\r\nc4699bf909ffea74d50312f5298ad6ac subversion-1.7.16-i486-1_slack14.0.txz\r\n\r\nSlackware x86_64 14.0 package:\r\n98c8987ecdd325400c7e2f0911367849 subversion-1.7.16-x86_64-1_slack14.0.txz\r\n\r\nSlackware 14.1 package:\r\n8525945c41a811583f4d95cadc6999d8 subversion-1.7.16-i486-1_slack14.1.txz\r\n\r\nSlackware x86_64 14.1 package:\r\n42ceb10a1df6173d6d840f68d19db5e2 subversion-1.7.16-x86_64-1_slack14.1.txz\r\n\r\nSlackware -current package:\r\n76a1890cb04f569b5eaf40da013a037e d/subversion-1.7.16-i486-1.txz\r\n\r\nSlackware x86_64 -current package:\r\nacdcd32e29e311059e8f2f1e383bf35b d/subversion-1.7.16-x86_64-1.txz\r\n\r\n\r\nInstallation instructions:\r\n+------------------------+\r\n\r\nUpgrade the package as root:\r\n# upgradepkg subversion-1.7.16-i486-1_slack14.1.txz\r\n\r\n\r\n+-----+\r\n\r\nSlackware Linux Security Team\r\nhttp://slackware.com/gpg-key\r\nsecurity@slackware.com\r\n\r\n+------------------------------------------------------------------------+\r\n| To leave the slackware-security mailing list: |\r\n+------------------------------------------------------------------------+\r\n| Send an email to majordomo@slackware.com with this text in the body of |\r\n| the email message: |\r\n| |\r\n| unsubscribe slackware-security |\r\n| |\r\n| You will get a confirmation message back containing instructions to |\r\n| complete the process. Please do not reply to this email address. |\r\n+------------------------------------------------------------------------+\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1\r\n\r\niEYEARECAAYFAlMPpxYACgkQakRjwEAQIjPt0QCfYWcNOcU3XxIhumk8+VobYwws\r\n0h4AoIk5DlSZ0AHHX/hs2hIsAxRIRCGu\r\n=ctwH\r\n-----END PGP SIGNATURE-----\r\n", "edition": 1, "modified": "2014-03-02T00:00:00", "published": "2014-03-02T00:00:00", "id": "SECURITYVULNS:DOC:30337", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:30337", "title": "[slackware-security] subversion &#40;SSA:2014-058-01&#41;", "type": "securityvulns", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-08-31T11:09:54", "bulletinFamily": "software", "cvelist": ["CVE-2014-0032", "CVE-2013-4558", "CVE-2013-4505"], "description": "mod_dontdothat protection bypass, DoS.", "edition": 1, "modified": "2014-03-02T00:00:00", "published": "2014-03-02T00:00:00", "id": "SECURITYVULNS:VULN:13510", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:13510", "title": "Apache Subversion security vulnerabilities", "type": "securityvulns", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}], "amazon": [{"lastseen": "2020-11-10T12:35:30", "bulletinFamily": "unix", "cvelist": ["CVE-2013-4558", "CVE-2013-4505"], "description": "**Issue Overview:**\n\nThe is_this_legal function in mod_dontdothat for Apache Subversion 1.4.0 through 1.7.13 and 1.8.0 through 1.8.4 allows remote attackers to bypass intended access restrictions and possibly cause a denial of service (resource consumption) via a relative URL in a REPORT request.\n\nThe get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1 through 1.8.4, when built with assertions enabled and SVNAutoversioning is enabled, allows remote attackers to cause a denial of service (assertion failure and Apache process abort) via a non-canonical URL in a request, as demonstrated using a trailing /.\n\n \n**Affected Packages:** \n\n\nsubversion\n\n \n**Issue Correction:** \nRun _yum update subversion_ to update your system.\n\n \n\n\n**New Packages:**\n \n \n i686: \n subversion-ruby-1.7.14-1.36.amzn1.i686 \n subversion-1.7.14-1.36.amzn1.i686 \n subversion-javahl-1.7.14-1.36.amzn1.i686 \n subversion-tools-1.7.14-1.36.amzn1.i686 \n subversion-libs-1.7.14-1.36.amzn1.i686 \n subversion-devel-1.7.14-1.36.amzn1.i686 \n mod_dav_svn-1.7.14-1.36.amzn1.i686 \n subversion-perl-1.7.14-1.36.amzn1.i686 \n subversion-python-1.7.14-1.36.amzn1.i686 \n subversion-debuginfo-1.7.14-1.36.amzn1.i686 \n \n src: \n subversion-1.7.14-1.36.amzn1.src \n \n x86_64: \n subversion-devel-1.7.14-1.36.amzn1.x86_64 \n subversion-perl-1.7.14-1.36.amzn1.x86_64 \n subversion-ruby-1.7.14-1.36.amzn1.x86_64 \n subversion-debuginfo-1.7.14-1.36.amzn1.x86_64 \n subversion-javahl-1.7.14-1.36.amzn1.x86_64 \n subversion-1.7.14-1.36.amzn1.x86_64 \n mod_dav_svn-1.7.14-1.36.amzn1.x86_64 \n subversion-libs-1.7.14-1.36.amzn1.x86_64 \n subversion-tools-1.7.14-1.36.amzn1.x86_64 \n subversion-python-1.7.14-1.36.amzn1.x86_64 \n \n \n", "edition": 4, "modified": "2013-12-17T21:39:00", "published": "2013-12-17T21:39:00", "id": "ALAS-2013-269", "href": "https://alas.aws.amazon.com/ALAS-2013-269.html", "title": "Medium: subversion", "type": "amazon", "cvss": {"score": 3.5, "vector": "AV:N/AC:M/Au:S/C:N/I:N/A:P"}}], "fedora": [{"lastseen": "2020-12-21T08:17:52", "bulletinFamily": "unix", "cvelist": ["CVE-2013-4505", "CVE-2013-4558"], "description": "Subversion is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. Subversion only stores the differences between versions, instead of every complete file. Subversion is intended to be a compelling replacement for CVS. ", "modified": "2013-12-11T02:00:11", "published": "2013-12-11T02:00:11", "id": "FEDORA:00DAD228C6", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 19 Update: subversion-1.7.14-1.fc19", "cvss": {"score": 3.5, "vector": "AV:N/AC:M/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2020-12-21T08:17:52", "bulletinFamily": "unix", "cvelist": ["CVE-2013-4505", "CVE-2013-4558"], "description": "Subversion is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. Subversion only stores the differences between versions, instead of every complete file. Subversion is intended to be a compelling replacement for CVS. ", "modified": "2013-12-11T02:00:39", "published": "2013-12-11T02:00:39", "id": "FEDORA:51181228C3", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 18 Update: subversion-1.7.14-1.fc18", "cvss": {"score": 3.5, "vector": "AV:N/AC:M/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2020-12-21T08:17:52", "bulletinFamily": "unix", "cvelist": ["CVE-2013-4505", "CVE-2013-4558"], "description": "Subversion is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. Subversion only stores the differences between versions, instead of every complete file. Subversion is intended to be a compelling replacement for CVS. ", "modified": "2013-12-31T19:02:57", "published": "2013-12-31T19:02:57", "id": "FEDORA:E660E22EE8", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 20 Update: subversion-1.8.5-2.fc20", "cvss": {"score": 3.5, "vector": "AV:N/AC:M/Au:S/C:N/I:N/A:P"}}], "nessus": [{"lastseen": "2021-01-01T05:50:03", "description": "The installed version of Subversion Server is affected by multiple\ndenial of service vulnerabilities :\n\n - An error exists related to the 'mod_dontdothat' module\n and handling relative URLs sent from serf-based\n clients. (CVE-2013-4505)\n\n - An error exists related to the 'mod_dav_svn' module and\n handling unspecified requests. Note that this issue\n reportedly only affects the 1.7 and 1.8 branches,\n including versions 1.7.11 through 1.7.13 and 1.8.1\n through 1.8.4. (CVE-2013-4558)", "edition": 24, "published": "2013-12-20T00:00:00", "title": "Apache Subversion 1.4.x - 1.7.13 / 1.8.x < 1.8.5 Multiple DoS", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-4558", "CVE-2013-4505"], "modified": "2021-01-02T00:00:00", "cpe": ["cpe:/a:apache:subversion"], "id": "SUBVERSION_1_8_5.NASL", "href": "https://www.tenable.com/plugins/nessus/71569", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(71569);\n script_version(\"1.4\");\n script_cvs_date(\"Date: 2018/07/30 15:31:32\");\n\n script_cve_id(\"CVE-2013-4505\", \"CVE-2013-4558\");\n script_bugtraq_id(63981, 63966);\n\n script_name(english:\"Apache Subversion 1.4.x - 1.7.13 / 1.8.x < 1.8.5 Multiple DoS\");\n script_summary(english:\"Checks Subversion Server version.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote host has an application that is affected by multiple denial\nof service vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The installed version of Subversion Server is affected by multiple\ndenial of service vulnerabilities :\n\n - An error exists related to the 'mod_dontdothat' module\n and handling relative URLs sent from serf-based\n clients. (CVE-2013-4505)\n\n - An error exists related to the 'mod_dav_svn' module and\n handling unspecified requests. Note that this issue\n reportedly only affects the 1.7 and 1.8 branches,\n including versions 1.7.11 through 1.7.13 and 1.8.1\n through 1.8.4. (CVE-2013-4558)\");\n script_set_attribute(attribute:\"see_also\", value:\"http://subversion.apache.org/security/CVE-2013-4505-advisory.txt\");\n script_set_attribute(attribute:\"see_also\", value:\"http://subversion.apache.org/security/CVE-2013-4558-advisory.txt\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Subversion Server 1.7.14 / 1.8.5 or later or apply the\nvendor patches or workarounds.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:S/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2013/11/25\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/11/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/12/20\");\n\n script_set_attribute(attribute:\"potential_vulnerability\", value:\"true\");\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:apache:subversion\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n\n script_copyright(english:\"This script is Copyright (C) 2013-2018 Tenable Network Security, Inc.\");\n\n script_dependencies(\"subversion_installed.nasl\");\n script_require_keys(\"installed_sw/Subversion Server\", \"Settings/ParanoidReport\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"install_func.inc\");\n\nappname = 'Subversion Server';\ninstall = get_single_install(app_name:appname, exit_if_unknown_ver:TRUE);\n\npath = install['path'];\nversion = install['version'];\nprovider = install['Packaged with'];\n\nif (report_paranoia < 2) audit(AUDIT_PARANOID);\n\n# Affected :\n# 1.4.0 through 1.7.13\n# 1.8.0 < 1.8.5\nif (\n (ver_compare(ver:version, fix:'1.4.0', strict:FALSE) >= 0 && ver_compare(ver:version, fix:'1.7.0', strict:FALSE) == -1) ||\n (ver_compare(ver:version, fix:'1.7.0', strict:FALSE) >= 0 && ver_compare(ver:version, fix:'1.7.13', strict:FALSE) == -1) ||\n (ver_compare(ver:version, fix:'1.8.0', strict:FALSE) >= 0 && ver_compare(ver:version, fix:'1.8.5', strict:FALSE) == -1)\n)\n{\n port = get_kb_item(\"SMB/transport\");\n if (!port) port = 445;\n\n if (report_verbosity > 0)\n {\n report = '\\n Path : ' + path +\n '\\n Packaged with : ' + provider +\n '\\n Installed version : ' + version +\n '\\n Fixed versions : 1.7.14 / 1.8.5' +\n '\\n';\n security_note(port:port, extra:report);\n }\n else security_note(port);\n exit(0);\n}\nelse audit(AUDIT_INST_PATH_NOT_VULN, provider + ' ' + appname, version, path);\n", "cvss": {"score": 3.5, "vector": "AV:N/AC:M/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2021-01-07T10:50:55", "description": "Subversion Project reports :\n\nmod_dontdothat does not restrict requests from serf based clients\n\nmod_dontdothat allows you to block update REPORT requests against\ncertain paths in the repository. It expects the paths in the REPORT\nrequest to be absolute URLs. Serf based clients send relative URLs\ninstead of absolute URLs in many cases. As a result these clients are\nnot blocked as configured by mod_dontdothat.\n\nmod_dav_svn assertion triggered by non-canonical URLs in\nautoversioning commits\n\nWhen SVNAutoversioning is enabled via SVNAutoversioning on commits can\nbe made by single HTTP requests such as MKCOL and PUT. If Subversion\nis built with assertions enabled any such requests that have\nnon-canonical URLs, such as URLs with a trailing /, may trigger an\nassert. An assert will cause the Apache process to abort.", "edition": 21, "published": "2013-11-26T00:00:00", "title": "FreeBSD : subversion -- multiple vulnerabilities (e3244a7b-5603-11e3-878d-20cf30e32f6d)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-4558", "CVE-2013-4505"], "modified": "2013-11-26T00:00:00", "cpe": ["cpe:/o:freebsd:freebsd", "p-cpe:/a:freebsd:freebsd:subversion"], "id": "FREEBSD_PKG_E3244A7B560311E3878D20CF30E32F6D.NASL", "href": "https://www.tenable.com/plugins/nessus/71088", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2018 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(71088);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2013-4505\", \"CVE-2013-4558\");\n\n script_name(english:\"FreeBSD : subversion -- multiple vulnerabilities (e3244a7b-5603-11e3-878d-20cf30e32f6d)\");\n script_summary(english:\"Checks for updated packages in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote FreeBSD host is missing one or more security-related\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Subversion Project reports :\n\nmod_dontdothat does not restrict requests from serf based clients\n\nmod_dontdothat allows you to block update REPORT requests against\ncertain paths in the repository. It expects the paths in the REPORT\nrequest to be absolute URLs. Serf based clients send relative URLs\ninstead of absolute URLs in many cases. As a result these clients are\nnot blocked as configured by mod_dontdothat.\n\nmod_dav_svn assertion triggered by non-canonical URLs in\nautoversioning commits\n\nWhen SVNAutoversioning is enabled via SVNAutoversioning on commits can\nbe made by single HTTP requests such as MKCOL and PUT. If Subversion\nis built with assertions enabled any such requests that have\nnon-canonical URLs, such as URLs with a trailing /, may trigger an\nassert. An assert will cause the Apache process to abort.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://subversion.apache.org/security/CVE-2013-4505-advisory.txt\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://subversion.apache.org/security/CVE-2013-4558-advisory.txt\"\n );\n # https://vuxml.freebsd.org/freebsd/e3244a7b-5603-11e3-878d-20cf30e32f6d.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?0829d9df\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:S/C:N/I:N/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:subversion\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2013/11/15\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/11/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/11/26\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"subversion>=1.4.0<1.7.14\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"subversion>=1.8.0<1.8.5\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_note(port:0, extra:pkg_report_get());\n else security_note(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 3.5, "vector": "AV:N/AC:M/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2021-01-12T10:11:24", "description": "This update includes the latest stable release of Apache Subversion\n1.7, version 1.7.14. Two security fixes are included :\n\nmod_dontdothat allows you to block update REPORT requests against\ncertain paths in the repository. It expects the paths in the REPORT\nrequest to be absolute URLs. Serf based clients send relative URLs\ninstead of absolute URLs in many cases. As a result these clients are\nnot blocked as configured by mod_dontdothat. (CVE-2013-4505)\n\nWhen SVNAutoversioning is enabled via 'SVNAutoversioning on' commits\ncan be made by single HTTP requests such as MKCOL and PUT. If\nSubversion is built with assertions enabled any such requests that\nhave non-canonical URLs, such as URLs with a trailing /, may trigger\nan assert. An assert will cause the Apache process to abort.\n(CVE-2013-4558)\n\nOther bug fixes included in this update are as follows :\n\nClient- and server-side bugfixes :\n\n - fix assertion on urls of the form 'file://./'\n\nClient-side bugfixes :\n\n - upgrade: fix an assertion when used with pre-1.3 wcs\n\n - fix externals that point at redirected locations\n\n - diff: fix incorrect calculation of changes in some\n cases\n\n - diff: fix errors with added/deleted targets\n\nServer-side bugfixes :\n\n - mod_dav_svn: Prevent crashes with some 3rd party modules\n\n - fix OOM on concurrent requests at threaded server\n start\n\n - fsfs: limit commit time of files with deep change\n histories\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 14, "published": "2013-12-11T00:00:00", "title": "Fedora 19 : subversion-1.7.14-1.fc19 (2013-22208)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-4558", "CVE-2013-4505"], "modified": "2013-12-11T00:00:00", "cpe": ["cpe:/o:fedoraproject:fedora:19", "p-cpe:/a:fedoraproject:fedora:subversion"], "id": "FEDORA_2013-22208.NASL", "href": "https://www.tenable.com/plugins/nessus/71326", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2013-22208.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(71326);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2013-4505\", \"CVE-2013-4558\");\n script_bugtraq_id(63966, 63981);\n script_xref(name:\"FEDORA\", value:\"2013-22208\");\n\n script_name(english:\"Fedora 19 : subversion-1.7.14-1.fc19 (2013-22208)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update includes the latest stable release of Apache Subversion\n1.7, version 1.7.14. Two security fixes are included :\n\nmod_dontdothat allows you to block update REPORT requests against\ncertain paths in the repository. It expects the paths in the REPORT\nrequest to be absolute URLs. Serf based clients send relative URLs\ninstead of absolute URLs in many cases. As a result these clients are\nnot blocked as configured by mod_dontdothat. (CVE-2013-4505)\n\nWhen SVNAutoversioning is enabled via 'SVNAutoversioning on' commits\ncan be made by single HTTP requests such as MKCOL and PUT. If\nSubversion is built with assertions enabled any such requests that\nhave non-canonical URLs, such as URLs with a trailing /, may trigger\nan assert. An assert will cause the Apache process to abort.\n(CVE-2013-4558)\n\nOther bug fixes included in this update are as follows :\n\nClient- and server-side bugfixes :\n\n - fix assertion on urls of the form 'file://./'\n\nClient-side bugfixes :\n\n - upgrade: fix an assertion when used with pre-1.3 wcs\n\n - fix externals that point at redirected locations\n\n - diff: fix incorrect calculation of changes in some\n cases\n\n - diff: fix errors with added/deleted targets\n\nServer-side bugfixes :\n\n - mod_dav_svn: Prevent crashes with some 3rd party modules\n\n - fix OOM on concurrent requests at threaded server\n start\n\n - fsfs: limit commit time of files with deep change\n histories\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1033431\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1033995\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2013-December/123377.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?525107e8\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected subversion package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:S/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:subversion\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:19\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/11/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/12/11\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^19([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 19.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC19\", reference:\"subversion-1.7.14-1.fc19\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_note(port:0, extra:rpm_report_get());\n else security_note(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"subversion\");\n}\n", "cvss": {"score": 3.5, "vector": "AV:N/AC:M/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2021-01-12T10:11:26", "description": "This update includes the latest stable release of Apache Subversion\n1.7, version 1.7.14. Two security fixes are included :\n\nmod_dontdothat allows you to block update REPORT requests against\ncertain paths in the repository. It expects the paths in the REPORT\nrequest to be absolute URLs. Serf based clients send relative URLs\ninstead of absolute URLs in many cases. As a result these clients are\nnot blocked as configured by mod_dontdothat. (CVE-2013-4505)\n\nWhen SVNAutoversioning is enabled via 'SVNAutoversioning on' commits\ncan be made by single HTTP requests such as MKCOL and PUT. If\nSubversion is built with assertions enabled any such requests that\nhave non-canonical URLs, such as URLs with a trailing /, may trigger\nan assert. An assert will cause the Apache process to abort.\n(CVE-2013-4558)\n\nOther bug fixes included in this update are as follows :\n\nClient- and server-side bugfixes :\n\n - fix assertion on urls of the form 'file://./'\n\nClient-side bugfixes :\n\n - upgrade: fix an assertion when used with pre-1.3 wcs\n\n - fix externals that point at redirected locations\n\n - diff: fix incorrect calculation of changes in some\n cases\n\n - diff: fix errors with added/deleted targets\n\nServer-side bugfixes :\n\n - mod_dav_svn: Prevent crashes with some 3rd party modules\n\n - fix OOM on concurrent requests at threaded server\n start\n\n - fsfs: limit commit time of files with deep change\n histories\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 14, "published": "2013-12-11T00:00:00", "title": "Fedora 18 : subversion-1.7.14-1.fc18 (2013-22313)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-4558", "CVE-2013-4505"], "modified": "2013-12-11T00:00:00", "cpe": ["cpe:/o:fedoraproject:fedora:18", "p-cpe:/a:fedoraproject:fedora:subversion"], "id": "FEDORA_2013-22313.NASL", "href": "https://www.tenable.com/plugins/nessus/71327", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2013-22313.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(71327);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2013-4505\", \"CVE-2013-4558\");\n script_bugtraq_id(63966, 63981);\n script_xref(name:\"FEDORA\", value:\"2013-22313\");\n\n script_name(english:\"Fedora 18 : subversion-1.7.14-1.fc18 (2013-22313)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update includes the latest stable release of Apache Subversion\n1.7, version 1.7.14. Two security fixes are included :\n\nmod_dontdothat allows you to block update REPORT requests against\ncertain paths in the repository. It expects the paths in the REPORT\nrequest to be absolute URLs. Serf based clients send relative URLs\ninstead of absolute URLs in many cases. As a result these clients are\nnot blocked as configured by mod_dontdothat. (CVE-2013-4505)\n\nWhen SVNAutoversioning is enabled via 'SVNAutoversioning on' commits\ncan be made by single HTTP requests such as MKCOL and PUT. If\nSubversion is built with assertions enabled any such requests that\nhave non-canonical URLs, such as URLs with a trailing /, may trigger\nan assert. An assert will cause the Apache process to abort.\n(CVE-2013-4558)\n\nOther bug fixes included in this update are as follows :\n\nClient- and server-side bugfixes :\n\n - fix assertion on urls of the form 'file://./'\n\nClient-side bugfixes :\n\n - upgrade: fix an assertion when used with pre-1.3 wcs\n\n - fix externals that point at redirected locations\n\n - diff: fix incorrect calculation of changes in some\n cases\n\n - diff: fix errors with added/deleted targets\n\nServer-side bugfixes :\n\n - mod_dav_svn: Prevent crashes with some 3rd party modules\n\n - fix OOM on concurrent requests at threaded server\n start\n\n - fsfs: limit commit time of files with deep change\n histories\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1033431\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1033995\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2013-December/123378.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?8b8ee83c\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected subversion package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:S/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:subversion\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:18\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/11/29\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/12/11\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^18([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 18.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC18\", reference:\"subversion-1.7.14-1.fc18\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_note(port:0, extra:rpm_report_get());\n else security_note(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"subversion\");\n}\n", "cvss": {"score": 3.5, "vector": "AV:N/AC:M/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2021-01-12T10:11:29", "description": "This update includes the latest stable release of Apache Subversion\n1.8, version 1.8.5. Two security fixes are included :\n\nmod_dontdothat allows you to block update REPORT requests against\ncertain paths in the repository. It expects the paths in the REPORT\nrequest to be absolute URLs. Serf based clients send relative URLs\ninstead of absolute URLs in many cases. As a result these clients are\nnot blocked as configured by mod_dontdothat. (CVE-2013-4505)\n\nWhen SVNAutoversioning is enabled via 'SVNAutoversioning on' commits\ncan be made by single HTTP requests such as MKCOL and PUT. If\nSubversion is built with assertions enabled any such requests that\nhave non-canonical URLs, such as URLs with a trailing /, may trigger\nan assert. An assert will cause the Apache process to abort.\n(CVE-2013-4558)\n\nOther fixes included in this update are as follows :\n\nClient-side bugfixes :\n\n - fix externals that point at redirected locations\n\n - diff: fix assertion with move inside a copy\n\nServer-side bugfixes :\n\n - mod_dav_svn: Prevent crashes with some 3rd party modules\n\n - mod_authz_svn: fix crash of mod_authz_svn with invalid\n config\n\n - hotcopy: fix hotcopy losing revprop files in packed\n repos\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 14, "published": "2014-01-02T00:00:00", "title": "Fedora 20 : subversion-1.8.5-2.fc20 (2013-22575)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-4558", "CVE-2013-4505"], "modified": "2014-01-02T00:00:00", "cpe": ["cpe:/o:fedoraproject:fedora:20", "p-cpe:/a:fedoraproject:fedora:subversion"], "id": "FEDORA_2013-22575.NASL", "href": "https://www.tenable.com/plugins/nessus/71775", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2013-22575.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(71775);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2013-4505\", \"CVE-2013-4558\");\n script_bugtraq_id(63966, 63981);\n script_xref(name:\"FEDORA\", value:\"2013-22575\");\n\n script_name(english:\"Fedora 20 : subversion-1.8.5-2.fc20 (2013-22575)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update includes the latest stable release of Apache Subversion\n1.8, version 1.8.5. Two security fixes are included :\n\nmod_dontdothat allows you to block update REPORT requests against\ncertain paths in the repository. It expects the paths in the REPORT\nrequest to be absolute URLs. Serf based clients send relative URLs\ninstead of absolute URLs in many cases. As a result these clients are\nnot blocked as configured by mod_dontdothat. (CVE-2013-4505)\n\nWhen SVNAutoversioning is enabled via 'SVNAutoversioning on' commits\ncan be made by single HTTP requests such as MKCOL and PUT. If\nSubversion is built with assertions enabled any such requests that\nhave non-canonical URLs, such as URLs with a trailing /, may trigger\nan assert. An assert will cause the Apache process to abort.\n(CVE-2013-4558)\n\nOther fixes included in this update are as follows :\n\nClient-side bugfixes :\n\n - fix externals that point at redirected locations\n\n - diff: fix assertion with move inside a copy\n\nServer-side bugfixes :\n\n - mod_dav_svn: Prevent crashes with some 3rd party modules\n\n - mod_authz_svn: fix crash of mod_authz_svn with invalid\n config\n\n - hotcopy: fix hotcopy losing revprop files in packed\n repos\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1033431\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1033995\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2013-December/125452.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?7663a73a\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected subversion package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:S/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:subversion\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:20\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/12/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/01/02\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^20([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 20.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC20\", reference:\"subversion-1.8.5-2.fc20\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_note(port:0, extra:rpm_report_get());\n else security_note(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"subversion\");\n}\n", "cvss": {"score": 3.5, "vector": "AV:N/AC:M/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2021-01-01T01:18:41", "description": "The is_this_legal function in mod_dontdothat for Apache Subversion\n1.4.0 through 1.7.13 and 1.8.0 through 1.8.4 allows remote attackers\nto bypass intended access restrictions and possibly cause a denial of\nservice (resource consumption) via a relative URL in a REPORT request.\n\nThe get_parent_resource function in repos.c in mod_dav_svn Apache\nHTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1\nthrough 1.8.4, when built with assertions enabled and\nSVNAutoversioning is enabled, allows remote attackers to cause a\ndenial of service (assertion failure and Apache process abort) via a\nnon-canonical URL in a request, as demonstrated using a trailing /.", "edition": 23, "published": "2013-12-23T00:00:00", "title": "Amazon Linux AMI : subversion (ALAS-2013-269)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-4558", "CVE-2013-4505"], "modified": "2021-01-02T00:00:00", "cpe": ["p-cpe:/a:amazon:linux:mod_dav_svn", "p-cpe:/a:amazon:linux:subversion-debuginfo", "p-cpe:/a:amazon:linux:subversion-devel", "p-cpe:/a:amazon:linux:subversion-libs", "p-cpe:/a:amazon:linux:subversion-perl", "p-cpe:/a:amazon:linux:subversion-ruby", "p-cpe:/a:amazon:linux:subversion", "p-cpe:/a:amazon:linux:subversion-javahl", "p-cpe:/a:amazon:linux:subversion-python", "cpe:/o:amazon:linux", "p-cpe:/a:amazon:linux:subversion-tools"], "id": "ALA_ALAS-2013-269.NASL", "href": "https://www.tenable.com/plugins/nessus/71581", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Amazon Linux AMI Security Advisory ALAS-2013-269.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(71581);\n script_version(\"1.4\");\n script_cvs_date(\"Date: 2018/04/18 15:09:35\");\n\n script_cve_id(\"CVE-2013-4505\", \"CVE-2013-4558\");\n script_xref(name:\"ALAS\", value:\"2013-269\");\n\n script_name(english:\"Amazon Linux AMI : subversion (ALAS-2013-269)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Amazon Linux AMI host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The is_this_legal function in mod_dontdothat for Apache Subversion\n1.4.0 through 1.7.13 and 1.8.0 through 1.8.4 allows remote attackers\nto bypass intended access restrictions and possibly cause a denial of\nservice (resource consumption) via a relative URL in a REPORT request.\n\nThe get_parent_resource function in repos.c in mod_dav_svn Apache\nHTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1\nthrough 1.8.4, when built with assertions enabled and\nSVNAutoversioning is enabled, allows remote attackers to cause a\ndenial of service (assertion failure and Apache process abort) via a\nnon-canonical URL in a request, as demonstrated using a trailing /.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://alas.aws.amazon.com/ALAS-2013-269.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Run 'yum update subversion' to update your system.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:S/C:N/I:N/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:mod_dav_svn\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:subversion\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:subversion-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:subversion-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:subversion-javahl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:subversion-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:subversion-perl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:subversion-python\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:subversion-ruby\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:subversion-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:amazon:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/12/17\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/12/23\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Amazon Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/AmazonLinux/release\", \"Host/AmazonLinux/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/AmazonLinux/release\");\nif (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, \"Amazon Linux\");\nos_ver = pregmatch(pattern: \"^AL(A|\\d)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Amazon Linux\");\nos_ver = os_ver[1];\nif (os_ver != \"A\")\n{\n if (os_ver == 'A') os_ver = 'AMI';\n audit(AUDIT_OS_NOT, \"Amazon Linux AMI\", \"Amazon Linux \" + os_ver);\n}\n\nif (!get_kb_item(\"Host/AmazonLinux/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (rpm_check(release:\"ALA\", reference:\"mod_dav_svn-1.7.14-1.36.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"subversion-1.7.14-1.36.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"subversion-debuginfo-1.7.14-1.36.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"subversion-devel-1.7.14-1.36.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"subversion-javahl-1.7.14-1.36.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"subversion-libs-1.7.14-1.36.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"subversion-perl-1.7.14-1.36.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"subversion-python-1.7.14-1.36.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"subversion-ruby-1.7.14-1.36.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"subversion-tools-1.7.14-1.36.amzn1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_note(port:0, extra:rpm_report_get());\n else security_note(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"mod_dav_svn / subversion / subversion-debuginfo / subversion-devel / etc\");\n}\n", "cvss": {"score": 3.5, "vector": "AV:N/AC:M/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2021-01-20T12:27:10", "description": "This update fixes the following issues with subversion :\n\n - bnc#850747: update to 1.7.14\n\n - CVE-2013-4505: mod_dontdothat does not restrict requests\n from serf clients.\n\n - CVE-2013-4558: mod_dav_svn assertion triggered by\n autoversioning commits.\n\n + Client- and server-side bugfixes :\n\n - fix assertion on urls of the form 'file://./'\n\n + Client-side bugfixes :\n\n - upgrade: fix an assertion when used with pre-1.3 wcs\n\n - fix externals that point at redirected locations\n\n - diff: fix incorrect calculation of changes in some cases\n\n - diff: fix errors with added/deleted targets\n\n + Server-side bugfixes :\n\n - mod_dav_svn: Prevent crashes with some 3rd party modules\n\n - fix OOM on concurrent requests at threaded server start\n\n - fsfs: limit commit time of files with deep change\n histories\n\n - mod_dav_svn: canonicalize paths properly\n\n + Other tool improvements and bugfixes :\n\n - mod_dontdothat: Fix the uri parser\n\n + Developer-visible changes :\n\n - javahl: canonicalize path for streamFileContent method\n\n + require python-sqlite when running regression tests", "edition": 20, "published": "2014-06-13T00:00:00", "title": "openSUSE Security Update : subversion (openSUSE-SU-2013:1860-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-4558", "CVE-2013-4505"], "modified": "2014-06-13T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:subversion-python", "p-cpe:/a:novell:opensuse:libsvn_auth_gnome_keyring-1-0", "cpe:/o:novell:opensuse:12.3", "p-cpe:/a:novell:opensuse:subversion-tools-debuginfo", "p-cpe:/a:novell:opensuse:subversion-debugsource", "p-cpe:/a:novell:opensuse:subversion-tools", "p-cpe:/a:novell:opensuse:subversion", "p-cpe:/a:novell:opensuse:subversion-bash-completion", "p-cpe:/a:novell:opensuse:libsvn_auth_kwallet-1-0", "p-cpe:/a:novell:opensuse:subversion-devel", "p-cpe:/a:novell:opensuse:subversion-server-debuginfo", "p-cpe:/a:novell:opensuse:subversion-perl", "p-cpe:/a:novell:opensuse:subversion-server", "p-cpe:/a:novell:opensuse:subversion-python-debuginfo", "p-cpe:/a:novell:opensuse:subversion-perl-debuginfo", "p-cpe:/a:novell:opensuse:libsvn_auth_kwallet-1-0-debuginfo", "p-cpe:/a:novell:opensuse:libsvn_auth_gnome_keyring-1-0-debuginfo", "cpe:/o:novell:opensuse:12.2", "p-cpe:/a:novell:opensuse:subversion-debuginfo"], "id": "OPENSUSE-2013-962.NASL", "href": "https://www.tenable.com/plugins/nessus/75226", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2013-962.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(75226);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2013-4505\", \"CVE-2013-4558\");\n script_bugtraq_id(63966, 63981);\n\n script_name(english:\"openSUSE Security Update : subversion (openSUSE-SU-2013:1860-1)\");\n script_summary(english:\"Check for the openSUSE-2013-962 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update fixes the following issues with subversion :\n\n - bnc#850747: update to 1.7.14\n\n - CVE-2013-4505: mod_dontdothat does not restrict requests\n from serf clients.\n\n - CVE-2013-4558: mod_dav_svn assertion triggered by\n autoversioning commits.\n\n + Client- and server-side bugfixes :\n\n - fix assertion on urls of the form 'file://./'\n\n + Client-side bugfixes :\n\n - upgrade: fix an assertion when used with pre-1.3 wcs\n\n - fix externals that point at redirected locations\n\n - diff: fix incorrect calculation of changes in some cases\n\n - diff: fix errors with added/deleted targets\n\n + Server-side bugfixes :\n\n - mod_dav_svn: Prevent crashes with some 3rd party modules\n\n - fix OOM on concurrent requests at threaded server start\n\n - fsfs: limit commit time of files with deep change\n histories\n\n - mod_dav_svn: canonicalize paths properly\n\n + Other tool improvements and bugfixes :\n\n - mod_dontdothat: Fix the uri parser\n\n + Developer-visible changes :\n\n - javahl: canonicalize path for streamFileContent method\n\n + require python-sqlite when running regression tests\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=850667\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=850747\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.opensuse.org/opensuse-updates/2013-12/msg00048.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected subversion packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:S/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libsvn_auth_gnome_keyring-1-0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libsvn_auth_gnome_keyring-1-0-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libsvn_auth_kwallet-1-0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libsvn_auth_kwallet-1-0-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:subversion\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:subversion-bash-completion\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:subversion-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:subversion-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:subversion-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:subversion-perl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:subversion-perl-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:subversion-python\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:subversion-python-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:subversion-server\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:subversion-server-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:subversion-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:subversion-tools-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:12.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:12.3\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/11/30\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/06/13\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE12\\.2|SUSE12\\.3)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"12.2 / 12.3\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE12.2\", reference:\"libsvn_auth_gnome_keyring-1-0-1.7.14-4.30.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.2\", reference:\"libsvn_auth_gnome_keyring-1-0-debuginfo-1.7.14-4.30.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.2\", reference:\"libsvn_auth_kwallet-1-0-1.7.14-4.30.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.2\", reference:\"libsvn_auth_kwallet-1-0-debuginfo-1.7.14-4.30.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.2\", reference:\"subversion-1.7.14-4.30.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.2\", reference:\"subversion-bash-completion-1.7.14-4.30.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.2\", reference:\"subversion-debuginfo-1.7.14-4.30.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.2\", reference:\"subversion-debugsource-1.7.14-4.30.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.2\", reference:\"subversion-devel-1.7.14-4.30.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.2\", reference:\"subversion-perl-1.7.14-4.30.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.2\", reference:\"subversion-perl-debuginfo-1.7.14-4.30.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.2\", reference:\"subversion-python-1.7.14-4.30.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.2\", reference:\"subversion-python-debuginfo-1.7.14-4.30.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.2\", reference:\"subversion-server-1.7.14-4.30.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.2\", reference:\"subversion-server-debuginfo-1.7.14-4.30.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.2\", reference:\"subversion-tools-1.7.14-4.30.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.2\", reference:\"subversion-tools-debuginfo-1.7.14-4.30.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.3\", reference:\"libsvn_auth_gnome_keyring-1-0-1.7.14-2.22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.3\", reference:\"libsvn_auth_gnome_keyring-1-0-debuginfo-1.7.14-2.22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.3\", reference:\"libsvn_auth_kwallet-1-0-1.7.14-2.22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.3\", reference:\"libsvn_auth_kwallet-1-0-debuginfo-1.7.14-2.22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.3\", reference:\"subversion-1.7.14-2.22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.3\", reference:\"subversion-bash-completion-1.7.14-2.22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.3\", reference:\"subversion-debuginfo-1.7.14-2.22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.3\", reference:\"subversion-debugsource-1.7.14-2.22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.3\", reference:\"subversion-devel-1.7.14-2.22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.3\", reference:\"subversion-perl-1.7.14-2.22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.3\", reference:\"subversion-perl-debuginfo-1.7.14-2.22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.3\", reference:\"subversion-python-1.7.14-2.22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.3\", reference:\"subversion-python-debuginfo-1.7.14-2.22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.3\", reference:\"subversion-server-1.7.14-2.22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.3\", reference:\"subversion-server-debuginfo-1.7.14-2.22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.3\", reference:\"subversion-tools-1.7.14-2.22.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.3\", reference:\"subversion-tools-debuginfo-1.7.14-2.22.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_note(port:0, extra:rpm_report_get());\n else security_note(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"subversion\");\n}\n", "cvss": {"score": 3.5, "vector": "AV:N/AC:M/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2021-01-20T12:27:09", "description": "This update fixes the following issues with subversion\n(CVE-2013-4505,CVE-2013-4558) :\n\n - bnc#850747: update to 1.8.5\n\n - CVE-2013-4505: mod_dontdothat does not restrict requests\n from serf clients.\n\n - CVE-2013-4558: mod_dav_svn assertion triggered by\n autoversioning commits.\n\n + Client-side bugfixes :\n\n - fix externals that point at redirected locations\n\n - diff: fix assertion with move inside a copy\n\n + Server-side bugfixes :\n\n - mod_dav_svn: Prevent crashes with some 3rd party modules\n\n - mod_dav_svn: canonicalize paths properly\n\n - mod_authz_svn: fix crash of mod_authz_svn with invalid\n config\n\n - hotcopy: fix hotcopy losing revprop files in packed\n repos\n\n + Other tool improvements and bugfixes :\n\n - mod_dontdothat: Fix the uri parser\n\n + Developer-visible changes :\n\n - fix compilation with '--enable-optimize' with clang\n\n - add test to fail when built against broken ZLib\n\n + Bindings :\n\n - ctypes-python: build with compiler selected via\n configure\n\n - require python-sqlite when running regression tests for\n all targets, no longer pulled in implicitly\n\n - print error logs on regression test failures\n\n - fix regression tests for ppc/ppc64 architectures, found\n in openSUSE package build and fixed with upstream\n developers\n\n - if running regression tests, also run them against bdb\n backend\n\n - update keyring, use Subversion Project Management\n Committee keyring rather than all committers", "edition": 19, "published": "2014-06-13T00:00:00", "title": "openSUSE Security Update : subversion (openSUSE-SU-2013:1836-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-4558", "CVE-2013-4505"], "modified": "2014-06-13T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:subversion-python", "p-cpe:/a:novell:opensuse:libsvn_auth_gnome_keyring-1-0", "p-cpe:/a:novell:opensuse:subversion-tools-debuginfo", "p-cpe:/a:novell:opensuse:subversion-debugsource", "p-cpe:/a:novell:opensuse:subversion-tools", "p-cpe:/a:novell:opensuse:subversion", "p-cpe:/a:novell:opensuse:subversion-bash-completion", "p-cpe:/a:novell:opensuse:libsvn_auth_kwallet-1-0", "p-cpe:/a:novell:opensuse:subversion-ruby", "p-cpe:/a:novell:opensuse:subversion-devel", "p-cpe:/a:novell:opensuse:subversion-server-debuginfo", "p-cpe:/a:novell:opensuse:subversion-perl", "p-cpe:/a:novell:opensuse:subversion-server", "p-cpe:/a:novell:opensuse:subversion-ruby-debuginfo", "p-cpe:/a:novell:opensuse:subversion-python-debuginfo", "p-cpe:/a:novell:opensuse:subversion-perl-debuginfo", "p-cpe:/a:novell:opensuse:libsvn_auth_kwallet-1-0-debuginfo", "p-cpe:/a:novell:opensuse:libsvn_auth_gnome_keyring-1-0-debuginfo", "cpe:/o:novell:opensuse:13.1", "p-cpe:/a:novell:opensuse:subversion-debuginfo"], "id": "OPENSUSE-2013-942.NASL", "href": "https://www.tenable.com/plugins/nessus/75223", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2013-942.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(75223);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2013-4505\", \"CVE-2013-4558\");\n\n script_name(english:\"openSUSE Security Update : subversion (openSUSE-SU-2013:1836-1)\");\n script_summary(english:\"Check for the openSUSE-2013-942 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update fixes the following issues with subversion\n(CVE-2013-4505,CVE-2013-4558) :\n\n - bnc#850747: update to 1.8.5\n\n - CVE-2013-4505: mod_dontdothat does not restrict requests\n from serf clients.\n\n - CVE-2013-4558: mod_dav_svn assertion triggered by\n autoversioning commits.\n\n + Client-side bugfixes :\n\n - fix externals that point at redirected locations\n\n - diff: fix assertion with move inside a copy\n\n + Server-side bugfixes :\n\n - mod_dav_svn: Prevent crashes with some 3rd party modules\n\n - mod_dav_svn: canonicalize paths properly\n\n - mod_authz_svn: fix crash of mod_authz_svn with invalid\n config\n\n - hotcopy: fix hotcopy losing revprop files in packed\n repos\n\n + Other tool improvements and bugfixes :\n\n - mod_dontdothat: Fix the uri parser\n\n + Developer-visible changes :\n\n - fix compilation with '--enable-optimize' with clang\n\n - add test to fail when built against broken ZLib\n\n + Bindings :\n\n - ctypes-python: build with compiler selected via\n configure\n\n - require python-sqlite when running regression tests for\n all targets, no longer pulled in implicitly\n\n - print error logs on regression test failures\n\n - fix regression tests for ppc/ppc64 architectures, found\n in openSUSE package build and fixed with upstream\n developers\n\n - if running regression tests, also run them against bdb\n backend\n\n - update keyring, use Subversion Project Management\n Committee keyring rather than all committers\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=850667\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=850747\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.opensuse.org/opensuse-updates/2013-12/msg00029.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected subversion packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:S/C:N/I:N/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libsvn_auth_gnome_keyring-1-0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libsvn_auth_gnome_keyring-1-0-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libsvn_auth_kwallet-1-0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libsvn_auth_kwallet-1-0-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:subversion\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:subversion-bash-completion\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:subversion-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:subversion-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:subversion-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:subversion-perl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:subversion-perl-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:subversion-python\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:subversion-python-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:subversion-ruby\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:subversion-ruby-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:subversion-server\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:subversion-server-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:subversion-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:subversion-tools-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:13.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/11/30\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/06/13\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE13\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"13.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libsvn_auth_gnome_keyring-1-0-1.8.5-2.11.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libsvn_auth_gnome_keyring-1-0-debuginfo-1.8.5-2.11.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libsvn_auth_kwallet-1-0-1.8.5-2.11.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libsvn_auth_kwallet-1-0-debuginfo-1.8.5-2.11.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"subversion-1.8.5-2.11.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"subversion-bash-completion-1.8.5-2.11.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"subversion-debuginfo-1.8.5-2.11.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"subversion-debugsource-1.8.5-2.11.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"subversion-devel-1.8.5-2.11.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"subversion-perl-1.8.5-2.11.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"subversion-perl-debuginfo-1.8.5-2.11.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"subversion-python-1.8.5-2.11.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"subversion-python-debuginfo-1.8.5-2.11.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"subversion-ruby-1.8.5-2.11.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"subversion-ruby-debuginfo-1.8.5-2.11.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"subversion-server-1.8.5-2.11.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"subversion-server-debuginfo-1.8.5-2.11.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"subversion-tools-1.8.5-2.11.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"subversion-tools-debuginfo-1.8.5-2.11.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_note(port:0, extra:rpm_report_get());\n else security_note(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"subversion\");\n}\n", "cvss": {"score": 3.5, "vector": "AV:N/AC:M/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2021-01-17T09:10:42", "description": "New subversion packages are available for Slackware 14.0, 14.1, and\n-current to fix denial-of-service issues.", "edition": 21, "published": "2014-02-28T00:00:00", "title": "Slackware 14.0 / 14.1 / current : subversion (SSA:2014-058-01)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-0032", "CVE-2013-4558", "CVE-2013-4505"], "modified": "2014-02-28T00:00:00", "cpe": ["cpe:/o:slackware:slackware_linux:14.1", "cpe:/o:slackware:slackware_linux:14.0", "cpe:/o:slackware:slackware_linux", "p-cpe:/a:slackware:slackware_linux:subversion"], "id": "SLACKWARE_SSA_2014-058-01.NASL", "href": "https://www.tenable.com/plugins/nessus/72731", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Slackware Security Advisory 2014-058-01. The text \n# itself is copyright (C) Slackware Linux, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(72731);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2013-4505\", \"CVE-2013-4558\", \"CVE-2014-0032\");\n script_bugtraq_id(63966, 63981, 65434);\n script_xref(name:\"SSA\", value:\"2014-058-01\");\n\n script_name(english:\"Slackware 14.0 / 14.1 / current : subversion (SSA:2014-058-01)\");\n script_summary(english:\"Checks for updated package in /var/log/packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Slackware host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"New subversion packages are available for Slackware 14.0, 14.1, and\n-current to fix denial-of-service issues.\"\n );\n # http://www.slackware.com/security/viewer.php?l=slackware-security&y=2014&m=slackware-security.394678\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?e6a55690\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected subversion package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:slackware:slackware_linux:subversion\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:14.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:14.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/02/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/02/28\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Slackware Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Slackware/release\", \"Host/Slackware/packages\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"slackware.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Slackware/release\")) audit(AUDIT_OS_NOT, \"Slackware\");\nif (!get_kb_item(\"Host/Slackware/packages\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Slackware\", cpu);\n\n\nflag = 0;\nif (slackware_check(osver:\"14.0\", pkgname:\"subversion\", pkgver:\"1.7.16\", pkgarch:\"i486\", pkgnum:\"1_slack14.0\")) flag++;\nif (slackware_check(osver:\"14.0\", arch:\"x86_64\", pkgname:\"subversion\", pkgver:\"1.7.16\", pkgarch:\"x86_64\", pkgnum:\"1_slack14.0\")) flag++;\n\nif (slackware_check(osver:\"14.1\", pkgname:\"subversion\", pkgver:\"1.7.16\", pkgarch:\"i486\", pkgnum:\"1_slack14.1\")) flag++;\nif (slackware_check(osver:\"14.1\", arch:\"x86_64\", pkgname:\"subversion\", pkgver:\"1.7.16\", pkgarch:\"x86_64\", pkgnum:\"1_slack14.1\")) flag++;\n\nif (slackware_check(osver:\"current\", pkgname:\"subversion\", pkgver:\"1.7.16\", pkgarch:\"i486\", pkgnum:\"1\")) flag++;\nif (slackware_check(osver:\"current\", arch:\"x86_64\", pkgname:\"subversion\", pkgver:\"1.7.16\", pkgarch:\"x86_64\", pkgnum:\"1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:slackware_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-01-17T14:01:12", "description": "The remote Solaris system is missing necessary patches to address\nsecurity updates :\n\n - The mod_dav_svn Apache HTTPD server module in Subversion\n 1.6.x through 1.6.20 and 1.7.0 through 1.7.8 allows\n remote attackers to cause a denial of service (NULL\n pointer dereference and crash) via a PROPFIND request\n for an activity URL. (CVE-2013-1849)\n\n - The is_this_legal function in mod_dontdothat for Apache\n Subversion 1.4.0 through 1.7.13 and 1.8.0 through 1.8.4\n allows remote attackers to bypass intended access\n restrictions and possibly cause a denial of service\n (resource consumption) via a relative URL in a REPORT\n request. (CVE-2013-4505)", "edition": 24, "published": "2015-01-19T00:00:00", "title": "Oracle Solaris Third-Party Patch Update : subversion (cve_2009_0179_denial_of1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-1849", "CVE-2013-4505"], "modified": "2015-01-19T00:00:00", "cpe": ["cpe:/o:oracle:solaris:11.1", "p-cpe:/a:oracle:solaris:subversion"], "id": "SOLARIS11_SUBVERSION_20140401.NASL", "href": "https://www.tenable.com/plugins/nessus/80777", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from the Oracle Third Party software advisories.\n#\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(80777);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2013-1849\", \"CVE-2013-4505\");\n\n script_name(english:\"Oracle Solaris Third-Party Patch Update : subversion (cve_2009_0179_denial_of1)\");\n script_summary(english:\"Check for the 'entire' version.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Solaris system is missing a security patch for third-party\nsoftware.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote Solaris system is missing necessary patches to address\nsecurity updates :\n\n - The mod_dav_svn Apache HTTPD server module in Subversion\n 1.6.x through 1.6.20 and 1.7.0 through 1.7.8 allows\n remote attackers to cause a denial of service (NULL\n pointer dereference and crash) via a PROPFIND request\n for an activity URL. (CVE-2013-1849)\n\n - The is_this_legal function in mod_dontdothat for Apache\n Subversion 1.4.0 through 1.7.13 and 1.8.0 through 1.8.4\n allows remote attackers to bypass intended access\n restrictions and possibly cause a denial of service\n (resource consumption) via a relative URL in a REPORT\n request. (CVE-2013-4505)\"\n );\n # https://www.oracle.com/technetwork/topics/security/thirdparty-patch-map-1482893.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?4a913f44\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://blogs.oracle.com/sunsecurity/cve-2013-1849-denial-of-servicedos-vulnerability-in-apache-subversion\"\n );\n # https://blogs.oracle.com/sunsecurity/cve-2013-4505-permissions,-privileges-and-access-control-vulnerability-in-apache-subversion\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?1353f24b\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Upgrade to Solaris 11.1.17.5.0.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:solaris:11.1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:solaris:subversion\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/04/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/01/19\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Solaris Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Solaris11/release\", \"Host/Solaris11/pkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"solaris.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Solaris11/release\");\nif (isnull(release)) audit(AUDIT_OS_NOT, \"Solaris11\");\npkg_list = solaris_pkg_list_leaves();\nif (isnull (pkg_list)) audit(AUDIT_PACKAGE_LIST_MISSING, \"Solaris pkg-list packages\");\n\nif (empty_or_null(egrep(string:pkg_list, pattern:\"^subversion$\"))) audit(AUDIT_PACKAGE_NOT_INSTALLED, \"subversion\");\n\nflag = 0;\n\nif (solaris_check_release(release:\"0.5.11-0.175.1.17.0.5.0\", sru:\"SRU 11.1.17.5.0\") > 0) flag++;\n\nif (flag)\n{\n error_extra = 'Affected package : subversion\\n' + solaris_get_report2();\n error_extra = ereg_replace(pattern:\"version\", replace:\"OS version\", string:error_extra);\n if (report_verbosity > 0) security_warning(port:0, extra:error_extra);\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_PACKAGE_NOT_AFFECTED, \"subversion\");\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}}], "slackware": [{"lastseen": "2020-10-25T16:36:28", "bulletinFamily": "unix", "cvelist": ["CVE-2013-4505", "CVE-2013-4558", "CVE-2014-0032"], "description": "New subversion packages are available for Slackware 14.0, 14.1, and -current to\nfix denial-of-service issues.\n\n\nHere are the details from the Slackware 14.1 ChangeLog:\n\npatches/packages/subversion-1.7.16-i486-1_slack14.1.txz: Upgraded.\n Fix denial of service bugs.\n For more information, see:\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4505\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4558\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0032\n (* Security fix *)\n\nWhere to find the new packages:\n\nThanks to the friendly folks at the OSU Open Source Lab\n(http://osuosl.org) for donating FTP and rsync hosting\nto the Slackware project! :-)\n\nAlso see the \"Get Slack\" section on http://slackware.com for\nadditional mirror sites near you.\n\nUpdated package for Slackware 14.0:\nftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/subversion-1.7.16-i486-1_slack14.0.txz\n\nUpdated package for Slackware x86_64 14.0:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/subversion-1.7.16-x86_64-1_slack14.0.txz\n\nUpdated package for Slackware 14.1:\nftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/subversion-1.7.16-i486-1_slack14.1.txz\n\nUpdated package for Slackware x86_64 14.1:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/subversion-1.7.16-x86_64-1_slack14.1.txz\n\nUpdated package for Slackware -current:\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/d/subversion-1.7.16-i486-1.txz\n\nUpdated package for Slackware x86_64 -current:\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/d/subversion-1.7.16-x86_64-1.txz\n\n\nMD5 signatures:\n\nSlackware 14.0 package:\nc4699bf909ffea74d50312f5298ad6ac subversion-1.7.16-i486-1_slack14.0.txz\n\nSlackware x86_64 14.0 package:\n98c8987ecdd325400c7e2f0911367849 subversion-1.7.16-x86_64-1_slack14.0.txz\n\nSlackware 14.1 package:\n8525945c41a811583f4d95cadc6999d8 subversion-1.7.16-i486-1_slack14.1.txz\n\nSlackware x86_64 14.1 package:\n42ceb10a1df6173d6d840f68d19db5e2 subversion-1.7.16-x86_64-1_slack14.1.txz\n\nSlackware -current package:\n76a1890cb04f569b5eaf40da013a037e d/subversion-1.7.16-i486-1.txz\n\nSlackware x86_64 -current package:\nacdcd32e29e311059e8f2f1e383bf35b d/subversion-1.7.16-x86_64-1.txz\n\n\nInstallation instructions:\n\nUpgrade the package as root:\n > upgradepkg subversion-1.7.16-i486-1_slack14.1.txz", "modified": "2014-02-27T21:06:12", "published": "2014-02-27T21:06:12", "id": "SSA-2014-058-01", "href": "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2014&m=slackware-security.394678", "type": "slackware", "title": "[slackware-security] subversion", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}}], "kaspersky": [{"lastseen": "2020-09-02T11:59:37", "bulletinFamily": "info", "cvelist": ["CVE-2013-4558"], "description": "### *Detect date*:\n07/12/2013\n\n### *Severity*:\nWarning\n\n### *Description*:\nAn assertion failure vulnerability was found in Apache Subversion. By exploiting this vulnerability malicious users can cause denial of service. This vulnerability can be exploited from the network at a point related to mod_dav_svn via a specially designed URL.\n\n### *Affected products*:\nApache Subversion versions 1.7.11 to 1.7.13 and 1.8.1 to 1.8.4\n\n### *Solution*:\nUpdate to latest version\n\n### *Original advisories*:\n[Apache bulletin](<https://subversion.apache.org/security/CVE-2013-4558-advisory.txt>) \n\n\n### *Impacts*:\nDoS \n\n### *Related products*:\n[Apache Subversion](<https://threats.kaspersky.com/en/product/Apache-Subversion/>)\n\n### *CVE-IDS*:\n[CVE-2013-4558](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4558>)3.5Warning", "edition": 40, "modified": "2020-05-22T00:00:00", "published": "2013-07-12T00:00:00", "id": "KLA10069", "href": "https://threats.kaspersky.com/en/vulnerability/KLA10069", "title": "\r KLA10069DoS vulnerability in Apache Subversion ", "type": "kaspersky", "cvss": {"score": 3.5, "vector": "AV:N/AC:M/Au:S/C:N/I:N/A:P"}}]}