[ GLSA 200407-20 ] Subversion: Vulnerability in mod_authz_svn

From: Joshua J. Berry (condordes_at_gentoo.org)
Date: 07/26/04

  • Next message: br00t_at_blueyonder.co.uk: "OSX Panther Internet Connect - Local root" 
    Date: Mon, 26 Jul 2004 11:26:37 -0700
To: gentoo-announce@lists.gentoo.org

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Gentoo Linux Security Advisory GLSA 200407-20
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                                http://security.gentoo.org/
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

      Severity: Low
         Title: Subversion: Vulnerability in mod_authz_svn
          Date: July 26, 2004
          Bugs: #57747
            ID: 200407-20

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Synopsis
    ========

    Users with write access to parts of a Subversion repository may bypass
    read restrictions in mod_authz_svn and read any part of the repository
    they wish.

    Background
    ==========

    Subversion is an advanced version control system, similar to CVS, which
    supports additional functionality such as the ability to move, copy and
    delete files and directories. A Subversion server may be run as an
    Apache module, a standalone server (svnserve), or on-demand over ssh (a
    la CVS' ":ext:" protocol). The mod_authz_svn Apache module works with
    Subversion in Apache to limit access to parts of Subversion
    repositories based on policy set by the administrator.

    Affected packages
    =================

        -------------------------------------------------------------------
         Package / Vulnerable / Unaffected
        -------------------------------------------------------------------
      1 dev-util/subversion <= 1.0.4-r1 >= 1.0.6

    Description
    ===========

    Users with write access to part of a Subversion repository may bypass
    read restrictions on any part of that repository. This can be done
    using an "svn copy" command to copy the portion of a repository the
    user wishes to read into an area where they have write access.

    Since copies are versioned, any such copy attempts will be readily
    apparent.

    Impact
    ======

    This is a low-risk vulnerability. It affects only users of Subversion
    who are running servers inside Apache and using mod_authz_svn.
    Additionally, this vulnerability may be exploited only by users with
    write access to some portion of a repository.

    Workaround
    ==========

    Keep sensitive content separated into different Subversion
    repositories, or disable the Apache Subversion server and use svnserve
    instead.

    Resolution
    ==========

    All Subversion users should upgrade to the latest available version:

        # emerge sync

        # emerge -pv ">=dev-util/subversion-1.0.6"
        # emerve ">=dev-util/subversion-1.0.6"

    References
    ==========

      [ 1 ] ChangeLog for Subversion 1.0.6
            http://svn.collab.net/repos/svn/tags/1.0.6/CHANGES

    Availability
    ============

    This GLSA and any updates to it are available for viewing at
    the Gentoo Security Website:

        http://security.gentoo.org/glsa/glsa-200407-20.xml

    Concerns?
    =========

    Security is a primary focus of Gentoo Linux and ensuring the
    confidentiality and security of our users machines is of utmost
    importance to us. Any security concerns should be addressed to
    security@gentoo.org or alternatively, you may file a bug at
    http://bugs.gentoo.org.

    License
    =======

    Copyright 2004 Gentoo Foundation, Inc; referenced text
    belongs to its owner(s).

    The contents of this document are licensed under the
    Creative Commons - Attribution / Share Alike license.

    http://creativecommons.org/licenses/by-sa/1.0

  • Next message: br00t_at_blueyonder.co.uk: "OSX Panther Internet Connect - Local root"

    Relevant Pages

    • [ GLSA 200407-20 ] Subversion: Vulnerability in mod_authz_svn
      ... Users with write access to parts of a Subversion repository may bypass ... Subversion in Apache to limit access to parts of Subversion ... Security is a primary focus of Gentoo Linux and ensuring the ...
      (Full-Disclosure)
    • [Full-Disclosure] [ GLSA 200407-20 ] Subversion: Vulnerability in mod_authz_svn
      ... Users with write access to parts of a Subversion repository may bypass ... Subversion in Apache to limit access to parts of Subversion ... Security is a primary focus of Gentoo Linux and ensuring the ...
      (Full-Disclosure)
    • Re: Apache22 + Subversion 1.6.6 = No go.
      ... Glen Johnson wrote: ... I am attempting to use FreeBSD as my Subversion server. ... Could not open the requested SVN filesystem ... each of those repository subdirectories would be created ...
      (freebsd-questions)
    • Re: Apache22 + Subversion 1.6.6 = No go.
      ... I am attempting to use FreeBSD as my Subversion server. ... and I have Apache working. ... Could not open the requested SVN filesystem ... each of those repository subdirectories would be created ...
      (freebsd-questions)
    • Re: Tool for document management
      ... I have been using Subversion for this very application for several ... the commit command does nothing; ... Simply create the repository on the other machine. ... This is because Subversion is able to commit using ssh, ...
      (Debian-User)