PT-2007-5081 · Apache+2 · Subversion+2

Publicado 2007-08-28 · Atualizado 2017-07-29 · CVE-2007-3846

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Subversion versions prior to 1.4.5 TortoiseSVN versions prior to 1.4.5

Description: The issue allows remote authenticated users to overwrite and create arbitrary files via a .. (dot dot backslash) sequence in the filename, as stored in the file repository, when run on Windows-based systems.

Recommendations: For Subversion versions prior to 1.4.5, update to version 1.4.5 or later. For TortoiseSVN versions prior to 1.4.5, update to version 1.4.5 or later.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2007-3846

Produtos afetados

Apache Subversion

Subversion

Tortoisesvn

Referências · 14

• http://secunia.com/advisories/26632 · Aviso do Fabricante
• http://subversion.tigris.org/servlets/ReadMsg?list=users&msgNo=69413 · Nota
• http://vupen.com/english/advisories/2007/3004 · Nota
• http://secunia.com/advisories/26625 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36312 · Nota
• http://osvdb.org/40118 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-3846 · Nota de Segurança
• http://subversion.tigris.org/servlets/NewsItemView?newsItemID=1941 · Correção
• http://osvdb.org/40119 · Nota
• http://securitytracker.com/id?1018617 · Nota
• http://tortoisesvn.net/node/291 · Correção
• http://securityfocus.com/bid/25468 · Nota
• http://crisp.cs.du.edu/?q=node/36 · Nota
• http://vupen.com/english/advisories/2007/3003 · Nota