PT-2014-3440 · Apache+5 · Apache Subversion+5

Published 2014-02-06 · Updated 2024-06-15 · CVE-2014-0032

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache Subversion versions prior to 1.7.15 Apache Subversion versions 1.8.x prior to 1.8.6

Description The issue allows remote attackers to cause a denial of service (crash) via vectors related to the server root and request methods other than GET. This can be demonstrated by the command "svn ls http://svn.example.com" when the SVNListParentPath is enabled.

Recommendations For Apache Subversion versions prior to 1.7.15, update to version 1.7.15 or later. For Apache Subversion versions 1.8.x prior to 1.8.6, update to version 1.8.6 or later.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2015-1708

CESA-2014_0255

CVE-2014-0032

DLA-207-1

MGASA-2014-0104

MGASA-2014-0105

OPENSUSE-SU-2024:10538-1

RHSA-2014:0255

RHSA-2014_0255

SUSE-SU-2014_0540-1

SUSE-SU-2015:0709-1

USN-2316-1

Affected Products

Alt Linux

Apache Subversion

Centos

Red Hat

Suse

Ubuntu

References · 116

• 🔥 http://mail-archives.apache.org/mod_mbox/subversion-dev/201401.mbox/[e-mail]%3E · Exploit
• https://bdu.fstec.ru/vul/2015-00404 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0248 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-0032 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1849 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0032 · Security Note
• https://security.gentoo.org/glsa/201610-05 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0032 · Security Note
• https://ubuntu.com/security/notices/USN-2316-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3504 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2112 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3522 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4131 · Security Note
• https://ubuntu.com/security/CVE-2014-3522 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1845 · Security Note