PT-2013-4932 · Apache+2 · Apache Subversion+2

Daniel Shahaf · Published 2013-09-13 · Updated 2024-06-15 · CVE-2013-4277

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:L/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Subversion versions 1.4.0 through 1.7.12 Apache Subversion versions 1.8.0 through 1.8.1

Description The issue allows local users to overwrite arbitrary files or kill arbitrary processes via a symlink attack on the file specified by the --pid-file option.

Recommendations For Apache Subversion versions 1.4.0 through 1.7.12, update to a version outside of this range to mitigate the risk. For Apache Subversion versions 1.8.0 through 1.8.1, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the --pid-file option until a patch is available.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

ALT-PU-2015-1708

CVE-2013-4277

MGASA-2013-0275

OPENSUSE-SU-2024:10538-1

SUSE-SU-2013_1643-1

SUSE-SU-2015:0709-1

Affected Products

Alt Linux

Apache Subversion

Suse

References · 86

• https://bdu.fstec.ru/vul/2015-00404 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0248 · Security Note
• http://subversion.apache.org/security/CVE-2013-4277-advisory.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4277 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1849 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0032 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4277 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3504 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2112 · Security Note
• https://ubuntu.com/security/CVE-2013-4277 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3522 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4131 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1845 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3528 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2013-4277 · Vendor Advisory