Vulnerability CVE-2013-4558
Published: 2013-12-07   Modified: 2013-12-08

Description:
The get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1 through 1.8.4, when built with assertions enabled and SVNAutoversioning is enabled, allows remote attackers to cause a denial of service (assertion failure and Apache process abort) via a non-canonical URL in a request, as demonstrated using a trailing /.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
mod_dav_svn 1.8.1 assertion triggered by non-canonical URLs
Philip Martin
10.12.2013

Type:

CWE-20

 (Improper Input Validation)

CVSS2 => (AV:N/AC:M/Au:S/C:N/I:N/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
3.5/10
2.9/10
6.8/10
Exploit range
Attack complexity
Authentication
Remote
Medium
Single time
Confidentiality impact
Integrity impact
Availability impact
None
None
Partial
Affected software
Apache -> Mod dav svn 
Apache -> Subversion 

 References:
http://subversion.apache.org/security/CVE-2013-4558-advisory.txt
https://bugzilla.redhat.com/show_bug.cgi?id=1033431
http://osvdb.org/100363
http://lists.opensuse.org/opensuse-updates/2013-12/msg00048.html
http://lists.opensuse.org/opensuse-updates/2013-12/msg00029.html
Copyright 2024, cxsecurity.com

 

Back to Top