PT-2013-4864 · Apache+1 · Apache Http Server+3

Ben Reser + 1 · Published 2013-07-31 · Updated 2024-06-15 · CVE-2013-4131

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Subversion versions 1.7.0 through 1.7.10 Subversion versions 1.8.x before 1.8.1

Description The issue allows remote authenticated users to cause a denial of service, potentially resulting in an assertion failure or out-of-bounds read. This can be achieved by sending a certain request against a revision root, specifically via COPY, DELETE, or MOVE requests.

Recommendations For Subversion versions 1.7.0 through 1.7.10, update to a version outside of this range to resolve the issue. For Subversion versions 1.8.x before 1.8.1, update to version 1.8.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the mod dav svn Apache HTTPD server module until a patch is available.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2015-1708

CVE-2013-4131

MGASA-2013-0244

OPENSUSE-SU-2024:10538-1

Affected Products

Alt Linux

Apache Http Server

Apache Subversion

Subversion

References · 77

• https://bdu.fstec.ru/vul/2015-00404 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0248 · Security Note
• https://osv.dev/vulnerability/MGASA-2013-0244 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-4131 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1849 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0032 · Security Note
• https://osv.dev/vulnerability/CVE-2013-4131 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3504 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2112 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3522 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4131 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1845 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3528 · Security Note
• http://lists.opensuse.org/opensuse-updates/2013-08/msg00000.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10538-1 · Vendor Advisory