1. Ubuntu Security Notices
  2. USN-1053-1

USN-1053-1: Subversion vulnerabilities

Publication date

1 February 2011

Overview

Releases

Packages

Details

It was discovered that Subversion incorrectly handled certain ‘partial
access’ privileges in rare scenarios. Remote authenticated users could use
this flaw to obtain sensitive information (revision properties). This issue
only applied to Ubuntu 6.06 LTS. (CVE-2007-2448)

It was discovered that the Subversion mod_dav_svn module for Apache did not
properly handle a named repository as a rule scope. Remote authenticated
users could use this flaw to bypass intended restrictions. This issue only
applied to Ubuntu 9.10, 10.04 LTS, and 10.10. (CVE-2010-3315)

It was discovered that the Subversion mod_dav_svn module for Apache
incorrectly handled the walk function. Remote authenticated users could use
this flaw to cause the service to crash, leading to a denial of service.
(CVE-2010-4539)

It was discovered that...

It was discovered that Subversion incorrectly handled certain ‘partial
access’ privileges in rare scenarios. Remote authenticated users could use
this flaw to obtain sensitive information (revision properties). This issue
only applied to Ubuntu 6.06 LTS. (CVE-2007-2448)

It was discovered that the Subversion mod_dav_svn module for Apache did not
properly handle a named repository as a rule scope. Remote authenticated
users could use this flaw to bypass intended restrictions. This issue only
applied to Ubuntu 9.10, 10.04 LTS, and 10.10. (CVE-2010-3315)

It was discovered that the Subversion mod_dav_svn module for Apache
incorrectly handled the walk function. Remote authenticated users could use
this flaw to cause the service to crash, leading to a denial of service.
(CVE-2010-4539)

It was discovered that Subversion incorrectly handled certain memory
operations. Remote authenticated users could use this flaw to consume large
quantities of memory and cause the service to crash, leading to a denial of
service. This issue only applied to Ubuntu 9.10, 10.04 LTS, and 10.10.
(CVE-2010-4644)

Update instructions

After a standard system update you need to restart any applications that use Subversion, such as Apache when using mod_dav_svn, to make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
9.10 karmic libapache2-svn –  1.6.5dfsg-1ubuntu1.1
libsvn1 –  1.6.5dfsg-1ubuntu1.1
8.04 hardy libapache2-svn –  1.4.6dfsg1-2ubuntu1.2
libsvn1 –  1.4.6dfsg1-2ubuntu1.2
6.06 dapper libapache2-svn –  1.3.1-3ubuntu1.3
libsvn0 –  1.3.1-3ubuntu1.3
10.10 maverick libapache2-svn –  1.6.12dfsg-1ubuntu1.1
libsvn1 –  1.6.12dfsg-1ubuntu1.1
10.04 lucid libapache2-svn –  1.6.6dfsg-2ubuntu1.1
libsvn1 –  1.6.6dfsg-2ubuntu1.1

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›