PT-2007-7456 · Apache · Subversion+1

Published 2007-04-10 · Updated 2024-06-15 · CVE-2013-4262

Positive Technologies (AI Summary)

CVSS v2.0

2.4

Low

Base vector

AV:L/AC:H/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Subversion versions 1.8.0 through 1.8.2

Description The issue allows local users to gain privileges via a symlink attack on the pid file when using the --pidfile option and running in foreground mode. This is related to the svnwcsub.py and irkerbridge.py utilities.

Recommendations For Subversion versions 1.8.0 through 1.8.2, update to version 1.8.3 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the --pidfile option when running in foreground mode to minimize the risk of exploitation.

Fix

LPE

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2013-4262

OPENSUSE-SU-2024:10538-1

Affected Products

Apache Subversion

Subversion

References · 46

• https://osv.dev/vulnerability/CVE-2013-4262 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-4262 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4262 · Security Note
• https://subversion.apache.org/security/CVE-2013-4262-advisory.txt · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4262 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10538-1 · Vendor Advisory
• https://suse.com/security/cve/CVE-2015-3184 · Note
• https://suse.com/security/cve/CVE-2013-1846 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4262 · Note
• https://suse.com/security/cve/CVE-2016-2168 · Note
• https://suse.com/security/cve/CVE-2015-3187 · Note
• https://suse.com/security/cve/CVE-2015-0251 · Note
• http://subversion.apache.org/security/CVE-2013-4262-advisory.txt · Note
• https://suse.com/security/cve/CVE-2010-4644 · Note
• https://suse.com/security/cve/CVE-2016-8734 · Note