PT-2013-4932 · Apache+2 · Apache Subversion+2

Daniel Shahaf · Publicado 2013-09-13 · Atualizado 2024-06-15 · CVE-2013-4277

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Baixa

Vetor base

AV:L/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Subversion versions 1.4.0 through 1.7.12 Apache Subversion versions 1.8.0 through 1.8.1

Description The issue allows local users to overwrite arbitrary files or kill arbitrary processes via a symlink attack on the file specified by the --pid-file option.

Recommendations For Apache Subversion versions 1.4.0 through 1.7.12, update to a version outside of this range to mitigate the risk. For Apache Subversion versions 1.8.0 through 1.8.1, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the --pid-file option until a patch is available.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

ALT-PU-2015-1708

CVE-2013-4277

MGASA-2013-0275

OPENSUSE-SU-2024:10538-1

SUSE-SU-2013_1643-1

SUSE-SU-2015:0709-1

Produtos afetados

Alt Linux

Apache Subversion

Suse

Referências · 86

• https://suse.com/security/cve/CVE-2015-3184 · Nota
• https://suse.com/security/cve/CVE-2013-1846 · Nota
• https://bdu.fstec.ru/vul/2015-00404 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0248 · Nota de Segurança
• https://suse.com/security/cve/CVE-2016-8734 · Nota
• https://suse.com/security/cve/CVE-2013-1968 · Nota
• http://subversion.apache.org/security/CVE-2013-4277-advisory.txt · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2015-5259 · Nota
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Nota
• https://bugzilla.novell.com/836245 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4277 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-4277 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1849 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0032 · Nota de Segurança
• https://suse.com/security/cve/CVE-2013-1845 · Nota