PT-2014-1442 · Apache+5 · Apache Subversion+5

Bert Huijben · Published 2014-08-05 · Updated 2024-06-15 · CVE-2014-3528

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache Subversion versions 1.0.0 through 1.7.x before 1.7.17 Apache Subversion versions 1.8.x before 1.8.10

Description The issue exists due to the storage of cached credentials based on MD5 hashes of URLs and authentication realms. This allows remote servers to obtain credentials by using a specially crafted authentication realm.

Recommendations For versions 1.0.0 through 1.7.x before 1.7.17, update to version 1.7.17 or later. For versions 1.8.x before 1.8.10, update to version 1.8.10 or later.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

ALT-PU-2015-1708

BDU:2015-00404

CESA-2015_0165

CESA-2015_0166

CVE-2014-3528

MGASA-2014-0338

MGASA-2014-0339

OPENSUSE-SU-2024:10538-1

RHSA-2015:0165

RHSA-2015:0166

RHSA-2015_0165

RHSA-2015_0166

SUSE-SU-2014_1071-1

SUSE-SU-2015:0709-1

USN-2316-1

Affected Products

Alt Linux

Apache Subversion

Centos

Red Hat

Suse

Ubuntu

References · 116

• https://bdu.fstec.ru/vul/2015-00404 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0248 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1849 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0032 · Security Note
• https://security.gentoo.org/glsa/201610-05 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2015-0165.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0166.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2316-1 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0165.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0338 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3504 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2112 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3522 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4131 · Security Note
• https://ubuntu.com/security/CVE-2014-3522 · Vendor Advisory