Subversion Date Parsing Function Buffer Overflow Vulnerability

Bugtraq ID:	10386
Class:	Boundary Condition Error
CVE:	CVE-2004-0397
Remote:	Yes
Local:	No
Published:	May 19 2004 12:00AM
Updated:	Oct 17 2007 03:07PM
Credit:	This issue was discovered by Stefan Esser <[email protected]>.
Vulnerable:	Subversion Subversion 1.0.2 Subversion Subversion 1.0.1 Subversion Subversion 1.0 Gentoo Linux 1.4
Not Vulnerable:	Subversion Subversion 1.0.3

Subversion Date Parsing Function Buffer Overflow Vulnerability

Subversion is prone to a buffer-overflow vulnerability that resides in one of its data-parsing functions. Specifically, Subversion calls an 'sscanf()' function when converting data strings to different formats. As a result, the software copies user-supplied data into an unspecified buffer without proper boundary checks.

Subversion 1.0.2 and prior versions are prone to this issue.

Subversion Date Parsing Function Buffer Overflow Vulnerability

The following exploits are available:

• /data/vulnerabilities/exploits/subexp.c
• /data/vulnerabilities/exploits/svnserve_date.pm
• /data/vulnerabilities/exploits/hoagie_subversion.c

Subversion Date Parsing Function Buffer Overflow Vulnerability

Solution:
Subversion 1.0.3 has been released to address this issue. Please see the references for more information.


Subversion Subversion 1.0

• OpenPKG subversion-1.0.0-2.0.2.src.rpm
  ftp://ftp.openpkg.org/release/2.0/UPD/subversion-1.0.0-2.0.2.src.rpm


• Subversion 1.0.3
  http://subversion.tigris.org/project_packages.html

Subversion Subversion 1.0.1

• Subversion 1.0.3
  http://subversion.tigris.org/project_packages.html

Subversion Subversion 1.0.2

• Subversion 1.0.3
  http://subversion.tigris.org/project_packages.html

Subversion Date Parsing Function Buffer Overflow Vulnerability

References:

• Advisory 08/2004 - Subversion remote vulnerability (Stefan Esser)
  
• Subversion Homepage (Subversion)