PT-2011-1598 · Apache+1 · Apache Subversion+1

Jan Lieskovsky · Published 2011-01-07 · Updated 2024-06-15 · CVE-2010-4539

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache Subversion versions prior to 1.6.15

Description The issue allows remote authenticated users to cause a denial of service, resulting in a daemon crash due to a NULL pointer dereference. This is achieved by triggering the walking of SVNParentPath collections.

Recommendations For versions prior to 1.6.15, update to version 1.6.15 or later to resolve the issue. As a temporary workaround, consider restricting access to the mod dav svn module to minimize the risk of exploitation.

Exploit

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2010-4539

OPENSUSE-SU-2024:10538-1

RHSA-2011:0257

RHSA-2011:0258

RHSA-2011_0257

RHSA-2011_0258

Affected Products

Apache Subversion

Red Hat

References · 80

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=667407 · Exploit
• 🔥 http://mail-archives.apache.org/mod_mbox/subversion-users/201011.mbox/[e-mail]%3E · Exploit
• http://openwall.com/lists/oss-security/2011/01/05/4 · Patch
• https://osv.dev/vulnerability/CVE-2010-4539 · Vendor Advisory
• http://openwall.com/lists/oss-security/2011/01/04/8 · Patch
• http://secunia.com/advisories/42780 · Vendor Advisory
• http://svn.apache.org/viewvc?view=revision&revision=1033166 · Patch
• http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053230.html · Vendor Advisory
• http://openwall.com/lists/oss-security/2011/01/04/10 · Patch
• http://redhat.com/support/errata/RHSA-2011-0258.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-4539 · Vendor Advisory
• http://ubuntu.com/usn/USN-1053-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:006 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10538-1 · Vendor Advisory