This update fixes the following security issues :

  - CVE-2015-5343: Possible remotely triggerable heap     overflow and out-of-bounds read in mod_dav_svn caused by     integer overflow when parsing skel-encoded request     bodies. (bsc#958300)

  - CVE-2015-3184: mod_authz_svn information leak     information in mixed anonymous/authenticated httpd (dav)     configurations (bsc#939514)

  - CVE-2015-3187: hidden paths leaked by path-based authz     (bsc#939517)

Several security issues have been found in the server components of the version control system subversion.

  - CVE-2015-3184     Subversion's mod_authz_svn does not properly restrict     anonymous access in some mixed anonymous/authenticated     environments when using Apache httpd 2.4. The result is     that anonymous access may be possible to files for which     only authenticated access should be possible. This issue     does not affect the oldstable distribution (wheezy)     because it only contains Apache httpd 2.2.

  - CVE-2015-3187     Subversion servers, both httpd and svnserve, will reveal     some paths that should be hidden by path-based authz.
    When a node is copied from an unreadable location to a     readable location the unreadable path may be revealed.
    This vulnerablity only reveals the path, it does not     reveal the contents of the path.

subversion was updated to version 1.8.14 to fix two security issues.

These security issues were fixed :

  - CVE-2015-3187: Information leak (only paths) that were     hidden by path-based authz (bsc#939517).

  - CVE-2015-3184: Information leak in mixed     anonymous/authenticated httpd (dav) configurations     (bsc#939514).

The remote host is affected by the vulnerability described in GLSA-201610-05 (Subversion, Serf: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Subversion and Serf.
      Please review the CVE identifiers referenced below for details   Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, conduct a man-in-the-middle attack, obtain       sensitive information, or cause a Denial of Service Condition.
  Workaround :

    There is no known workaround at this time.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1742 advisory.

    [1.7.14-7.1]
    - add security fixes for CVE-2015-0248, CVE-2015-0251, CVE-2015-3184,       CVE-2015-3187

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2721-1 advisory.

    It was discovered that the Subversion mod_dav_svn module incorrectly handled REPORT requests for a     resource that does not exist. A remote attacker could use this issue to cause the server to crash,     resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS.
    (CVE-2014-3580)

    It was discovered that the Subversion mod_dav_svn module incorrectly handled requests requiring a lookup     for a virtual transaction name that does not exist. A remote attacker could use this issue to cause the     server to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS.
    (CVE-2014-8108)

    Evgeny Kotkov discovered that the Subversion mod_dav_svn module incorrectly handled large numbers of     REPORT requests. A remote attacker could use this issue to cause the server to crash, resulting in a     denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-0202)

    Evgeny Kotkov discovered that the Subversion mod_dav_svn and svnserve modules incorrectly certain crafted     parameter combinations. A remote attacker could use this issue to cause the server to crash, resulting in     a denial of service. (CVE-2015-0248)

    Ivan Zhakov discovered that the Subversion mod_dav_svn module incorrectly handled crafted v1 HTTP protocol     request sequences. A remote attacker could use this issue to spoof the svn:author property.
    (CVE-2015-0251)

    C. Michael Pilato discovered that the Subversion mod_dav_svn module incorrectly restricted anonymous     access. A remote attacker could use this issue to read hidden files via the path name. This issue only     affected Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-3184)

    C. Michael Pilato discovered that Subversion incorrectly handled path-based authorization. A remote     attacker could use this issue to obtain sensitive path information. (CVE-2015-3187)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apple Xcode installed on the remote Mac OS X host is prior to 7.3. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in Apache Subversion in mod_authz_svn due to a failure to properly restrict anonymous     access. An unauthenticated, remote attacker can exploit this, via a crafted path name, to read hidden     files. (CVE-2015-3184)

  - A flaw exists in Apache Subversion in the svn_repos_trace_node_locations() function that causes the first     readable path to be returned when it encounters an unreadable path when following a node's history. An     authenticated, remote attacker can exploit this to access paths that were intended to be hidden.
    (CVE-2015-3187)

  - Multiple unspecified memory corruption issues exist in otool due to improper validation of user-supplied     input. A local attacker can exploit these to cause a denial of service or to execute arbitrary code.
    (CVE-2016-1765)

It was found that when an SVN server (both svnserve and httpd with the mod_dav_svn module) searched the history of a file or a directory, it would disclose its location in the repository if that file or directory was not readable (for example, if it had been moved).
(CVE-2015-3187)

An integer overflow was discovered allowing remote attackers to execute arbitrary code via an svn:// protocol string, which triggers a heap-based buffer overflow and an out-of-bounds read. (CVE-2015-5259)

It was found that the mod_authz_svn module did not properly restrict anonymous access to Subversion repositories under certain configurations when used with Apache httpd 2.4.x. This could allow a user to anonymously access files in a Subversion repository, which should only be accessible to authenticated users. (CVE-2015-3184)

It was found that the mod_dav_svn module was vulnerable to a remotely triggerable heap-based buffer overflow and out-of-bounds read caused by an integer overflow when parsing skel-encoded request bodies, allowing an attacker with write access to a repository to cause a denial of service attack (on 32-bit or 64-bit servers) or possibly execute arbitrary code (on 32-bit servers only) under the context of the httpd process. (CVE-2015-5343)

ID	名前	製品	ファミリー	公開日	更新日	深刻度
87624	openSUSE Security Update : subversion (openSUSE-2015-949)	Nessus	SuSE Local Security Checks	2015/12/29	2021/1/19	high
85354	Debian DSA-3331-1 : subversion - security update	Nessus	Debian Local Security Checks	2015/8/13	2021/1/11	medium
85524	openSUSE Security Update : subversion (openSUSE-2015-549)	Nessus	SuSE Local Security Checks	2015/8/19	2021/1/19	medium
93992	GLSA-201610-05 : Subversion, Serf: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2016/10/12	2026/1/22	high
85865	Oracle Linux 7 : subversion (ELSA-2015-1742)	Nessus	Oracle Linux Local Security Checks	2015/9/9	2024/11/1	high
85579	Ubuntu 14.04 LTS : Subversion vulnerabilities (USN-2721-1)	Nessus	Ubuntu Local Security Checks	2015/8/21	2025/9/3	high
90148	Apple Xcode < 7.3 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	2016/3/24	2020/5/5	medium
90269	Amazon Linux AMI : mod_dav_svn / subversion (ALAS-2016-676)	Nessus	Amazon Linux Local Security Checks	2016/4/1	2018/4/18	high

検出

プラグインの検索

high

medium

medium

high

high

high

medium

high